CVE-2020-1937: SQL Injection
First published: Mon Feb 24 2020(Updated: )
Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Kylin | >=2.3.0<=2.3.2 | |
| Apache Kylin | >=2.4.0<=2.4.1 | |
| Apache Kylin | >=2.5.0<=2.5.2 | |
| Apache Kylin | >=2.6.0<=2.6.4 | |
| Apache Kylin | =3.0.0 | |
| Apache Kylin | =3.0.0-alpha | |
| Apache Kylin | =3.0.0-alpha2 | |
| Apache Kylin | =3.0.0-beta |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0@%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
Frequently Asked Questions
What is CVE-2020-1937?
CVE-2020-1937 is a vulnerability found in Apache Kylin, allowing an attacker to run malicious database queries through RESTful APIs.
What is the severity of CVE-2020-1937?
The severity of CVE-2020-1937 is high, with a CVSS score of 8.8 out of 10.
Which versions of Apache Kylin are affected by CVE-2020-1937?
Apache Kylin versions 2.3.0 to 2.3.2, 2.4.0 to 2.4.1, 2.5.0 to 2.5.2, and 2.6.0 to 2.6.4 are affected by CVE-2020-1937.
How can an attacker exploit CVE-2020-1937?
An attacker can exploit CVE-2020-1937 by concatenating SQLs with user input strings through the affected RESTful APIs.
Are there any known references related to CVE-2020-1937?
Yes, you can find more information about CVE-2020-1937 and its references at the following links: <REFERENCE 1>, <REFERENCE 2>, <REFERENCE 3>.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache kylin
- version/apache kylin/2.3.0
- version/apache kylin/2.3.2
- version/apache kylin/2.4.0
- version/apache kylin/2.4.1
- version/apache kylin/2.5.0
- version/apache kylin/2.5.2
- version/apache kylin/2.6.0
- version/apache kylin/2.6.4
- version/apache kylin/3.0.0
- version/apache kylin/3.0.0-alpha
- version/apache kylin/3.0.0-alpha2
- version/apache kylin/3.0.0-beta