PT-2020-15176 · Apache · Kylin

Published 2020-02-24 · Updated 2021-12-30 · CVE-2020-1937

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Kylin (affected versions not specified)

Description The issue concerns Kylin's RESTful APIs, which concatenate SQL commands with user input strings. This allows a user to potentially run malicious database queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-1937

GHSA-7HMH-8GWV-MFVQ

Affected Products

Kylin

References · 12

• https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7hmh-8gwv-mfvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1937 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1937 · Vendor Advisory
• https://github.com/apache/kylin · Note
• https://github.com/apache/kylin/commit/e373c64c96a54a7abfe4bccb82e8feb60db04749 · Note
• https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEKYLIN-552148 · Note
• https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0@%3Ccommits.kylin.apache.org%3E · Note
• https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E · Note
• https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E · Note
• https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E · Note
• https://t.me/cvenotify/1191 · Telegram Post