« Volver al listado

CVE-2020-9483

Estado: ModificadaAlta (7.5)—

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Skywalking

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9483",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Apache SkyWalking",
          "versions": [
            {
              "status": "affected",
              "version": "Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-30T15:15:10.320",
  "references": [
    {
      "url": "https://github.com/apache/skywalking/pull/4639",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/skywalking/pull/4639",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters."
    },
    {
      "lang": "es",
      "value": "**Resuelto** Cuando usa H2/MySQL/TiDB como almacenamiento de Apache SkyWalking, la consulta de metadatos por medio del protocolo GraphQL, presenta una vulnerabilidad de inyección SQL, que permite acceder a datos no extraídos. Las implementaciones de almacenamiento H2/MySQL/TiDB de Apache SkyWalking versiones 6.0.0 hasta 6.6.0, y 7.0.0 no usan la manera apropiada para ajustar los parámetros SQL"
    }
  ],
  "lastModified": "2026-06-17T03:28:01.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:skywalking:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B7F9770-0CE6-49EB-9615-0E810534BABE",
              "versionEndIncluding": "6.6.0",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:skywalking:7.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5C5A2EB-0DF4-4172-BEDB-2D7ED9F43917"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}