CVE-2020-13921: 
Java vulnerability analysis and mitigation

CVE-2020-13921 is a SQL injection vulnerability affecting Apache SkyWalking versions 6.5.0, 6.6.0, 7.0.0, 8.0.0, and 8.0.1. The vulnerability specifically occurs when using H2/MySQL/TiDB as Apache SkyWalking storage, where SQL injection is possible in wildcard query cases (OpenWall).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability specifically manifests in the wildcard query functionality when using specific storage backends including H2, MySQL, or TiDB (NVD).

Given the CRITICAL CVSS score of 9.8, this vulnerability could potentially allow attackers to execute arbitrary SQL commands on the affected database systems. The vulnerability affects the confidentiality, integrity, and availability of the system, with all three aspects rated as 'High' in the CVSS scoring (NVD).

The vulnerability has a low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) to exploit, making it highly exploitable. The attack vector is network-based (AV:N), allowing for remote exploitation (NVD).

The vulnerability has been resolved through a fix implemented in pull request #4970 on the Apache SkyWalking GitHub repository. Users should upgrade to a patched version of the software to mitigate this vulnerability (GitHub PR).