~ / search / GHSA-7hmh-8gwv-mfvq

GHSA-7hmh-8gwv-mfvq

SQL Injection in Kylin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-1937

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.kylin:kylin-server-base < 2.6.5 2.6.5
Maven org.apache.kylin:kylin-server-base >= 3.0.0, < 3.0.1 3.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

References

External links from the advisory. They lead to third-party sites.