Executive brief
Apache SkyWalking, an application performance monitoring tool, is vulnerable to a security flaw where malicious scripts can be stored and executed in a user's browser. If an attacker successfully exploits this, they could potentially hijack user sessions or perform unauthorized actions on behalf of legitimate users when they view certain pages within the SkyWalking interface. This could lead to unauthorized access to monitoring data or administrative functions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Apache SkyWalking versions up to and including 10.2.0. The root cause is the improper neutralization of script-related HTML tags (CWE-80) within the web application component. An attacker can inject malicious scripts that are stored on the server and later executed in the context of a victim's browser session when they navigate to the affected page. Exploitation requires network reachability and some level of user interaction (viewing the malicious content), but does not require prior authentication. The issue is resolved in version 10.3.0.
Affected products
- Apache SkyWalking <= 10.2.0
Timeline
- 2025-11-27: disclosed
- 2025-11-27: advisory