You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@skywalking.apache.org by Sheng Wu <wu...@apache.org> on 2020/06/15 07:44:58 UTC

Subject: [CVE-2020-9483] Apache SkyWalking SQL injection vulnerability

[CVEID]:CVE-2020-9483
[PRODUCT]:Apache SkyWalking
[VERSION]:Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0
[PROBLEMTYPE]:SQL Injection
[DESCRIPTION]: When use H2/MySQL/TiDB as Apache SkyWalking storage, the
metadata query through GraphQL protocol, there is a SQL injection
vulnerability,
               which allows to access unpexcted data. Apache SkyWalking
6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the
appropriate
               way to set SQL parameters.

Sheng Wu 吴晟
Twitter, wusheng1108