CVE-2020-9483 describes a critical SQL injection vulnerability in Apache SkyWalking versions 6.0.0 to 6.6.0 and 7.0.0 when using H2, MySQL, or TiDB for storage. This flaw allows an unauthenticated attacker to access unexpected data through the GraphQL protocol due to improper SQL parameter handling. With a CVSS score of 7.5 (HIGH) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk for data compromise. While not actively exploited in the wild, public Nuclei templates exist, and its high FAUCET Risk Score of 99/100 underscores its potential impact. Despite the severity, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.0.0, <= 6.6.0CPE matchmatch criteria | cpe:2.3:a:apache:skywalking:*:*:*:*:*:*:*:* | ||
7.0.0CPE matchmatch criteria | cpe:2.3:a:apache:skywalking:7.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.