Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database…

Description

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

Scores

EPSS (exploitation in 30 days)

3.1% · top 12% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• SQL injection
• CWE-89 (opens in a new tab)All about CWE-89 and its CVEs

Affected products

• Apache · Apache Kylin

  • affected ApacheKylin 2.3.0 to 2.3.2
  • affected 2.4.0 to 2.4.1
  • affected 2.5.0 to 2.5.2
  • affected 2.6.0 to 2.6.4
  • affected 3.0.0-alpha
  • affected 3.0.0-alpha2
  • affected 3.0.0-beta
  • affected 3.0.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.kylin:kylin-server-baseGHSA-7hmh-8gwv-mfvq (opens in a new tab)

References (3)

• [kylin-user] 20200223 [CVE-2020-1937] Apache Kylin SQL injection vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7hmh-8gwv-mfvq (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-1937](https://trackcve.app/badge/CVE-2020-1937.svg)](https://trackcve.app/cve/CVE-2020-1937)

Record last updated 4 Aug 2024, 06:53 UTC.