GitHub Advisoryadvisory · Maven

GHSA-7hmh-8gwv-mfvq SQL Injection in Kylin

MEDIUM Published 2020-07-27 Modified 2021-09-22 Official page ↗
Aliases
CVE-2020-1937
Ecosystem
Maven
Packages
org.apache.kylin:kylin-server-base
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-89
Reviewed
2020-07-27

Affected packages

• Maven org.apache.kylin:kylin-server-base: < 2.6.5 → fixed in 2.6.5 • Maven org.apache.kylin:kylin-server-base: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

Related

Alias · CVE (1)

  • CVE-2020-1937 Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References