What is GHSA-grpf-gg7v-5g5h?

GHSA-grpf-gg7v-5g5h is a security advisory published by GitHub Security Advisories with Critical severity. SQL Injection in Apache SkyWalking

Which CVE IDs does GHSA-grpf-gg7v-5g5h cover?

GHSA-grpf-gg7v-5g5h covers the following CVE IDs: CVE-2020-13921. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-grpf-gg7v-5g5h?

GHSA-grpf-gg7v-5g5h has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-grpf-gg7v-5g5h?

GHSA-grpf-gg7v-5g5h affects 1 product, including: maven/org.apache.skywalking:oap-server:\u003c 8.1.0.

GHSA-grpf-gg7v-5g5hCriticalCVSS 9.8

SQL Injection in Apache SkyWalking

Vendor

GitHub Security Advisories

Published

May 7, 2021

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2020-13921 →

📋 Description

Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

🎯 Affected products1

maven/org.apache.skywalking:oap-server:< 8.1.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2020-13921
https://github.com/apache/skywalking/pull/4970
https://github.com/apache/skywalking/commit/fb7912c6bdda06a233f4b3e18e71a87d3e4a8951
https://lists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6@%3Cdev.skywalking.apache.org%3E
http://www.openwall.com/lists/oss-security/2020/08/05/3
https://github.com/pypa/advisory-database/tree/main/vulns/apache-skywalking/PYSEC-2020-342.yaml
https://lists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6%40%3Cdev.skywalking.apache.org%3E
https://github.com/advisories/GHSA-grpf-gg7v-5g5h