{"id":"CVE-2020-1937","published":"2020-02-24T20:57:52Z","modified":"2024-08-04T06:53:59Z","title":"Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run…","vendor":"Apache","product":"Apache Kylin","tier":"tail","description":{"text":"Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0307,"percentile":0.8761,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":22.5,"factors":[{"name":"EPSS percentile","points":17.52},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-01-06","earliestUrl":"https://github.com/shanika04/apache_kylin","repos":[{"name":"shanika04/apache_kylin","url":"https://github.com/shanika04/apache_kylin","stars":1,"created":"2021-01-06"}]},"first":{"date":"2021-01-06","source":"PoC-in-GitHub","url":"https://github.com/shanika04/apache_kylin"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache","product":"Apache Kylin","versions":["ApacheKylin 2.3.0 to 2.3.2","2.4.0 to 2.4.1","2.5.0 to 2.5.2","2.6.0 to 2.6.4","3.0.0-alpha","3.0.0-alpha2","3.0.0-beta","3.0.0"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.kylin:kylin-server-base","vulnerableRanges":["<2.6.5",">=3.0.0, <3.0.1"],"patched":["2.6.5","3.0.1"],"from":["GHSA-7hmh-8gwv-mfvq"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0542","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-kylin-cve-2020-1937","children":[{"from":"CVE-2020-1937","to":"CVE-2020-1956","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server-base/src/main/java/org/apache/kylin/rest/service/CubeService.java"],"commits":["https://github.com/apache/kylin/commit/e373c64c96a54a7abfe4bccb82e8feb60db04749","https://github.com/apache/kylin/commit/58fad56ac6aaa43c6bd8f962d7f2d84438664092"],"basis":"shared function","functions":["migrateCube"]},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2020-1937","published":"2020-02-24","fixed":"3.0.1","kev":false},{"cve":"CVE-2020-13925","published":"2020-07-14","fixed":"3.1.0","kev":false,"link":{"from":"CVE-2020-1937","to":"CVE-2020-13925","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.kylin:kylin-server-base","fromFixed":"3.0.1","toFixed":"3.1.0","daysApart":141}]}},{"cve":"CVE-2020-13926","published":"2020-07-14","fixed":"3.1.0","kev":false,"link":{"from":"CVE-2020-1937","to":"CVE-2020-13926","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.kylin:kylin-server-base","fromFixed":"3.0.1","toFixed":"3.1.0","daysApart":141}]}},{"cve":"CVE-2022-24697","published":"2022-10-13","fixed":"4.0.2","kev":false}],"package":"Maven:org.apache.kylin:kylin-server-base"}}