CVE-2020-13921 SQL Injection in Apache SkyWalking
SQL injection in Apache SkyWalking allows attackers to manipulate database queries when using specific storage backends.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13921?
CVE-2020-13921 is a critical SQL injection vulnerability in Apache SkyWalking, published on 5 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
Weakness: CWE-89
Which versions are affected by CVE-2020-13921?
3 open source packages ship an affected version, including org.apache.skywalking:oap-server and apache-skywalking. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.skywalking:oap-server Maven | All versions | 8.1.0 |
org.apache.skywalking:oap-server Maven | All versions | 8.1.0 |
apache-skywalking PyPI | All versions | None |
Products include Apache Skywalking.
How do I fix CVE-2020-13921?
Upgrade org.apache.skywalking:oap-server to 8.1.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-13921 being exploited?
There is no known exploitation of CVE-2020-13921 in the wild and no public exploit code.
Other vulnerabilities in Apache SkyWalking
Sources
Also known as GHSA-grpf-gg7v-5g5h, PYSEC-2020-342.