« Volver al listado

CVE-2020-1937

Estado: ModificadaAlta (8.8)—

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Kylin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-1937",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache",
          "product": "Apache Kylin",
          "versions": [
            {
              "status": "affected",
              "version": "ApacheKylin 2.3.0 to 2.3.2"
            },
            {
              "status": "affected",
              "version": "2.4.0 to 2.4.1"
            },
            {
              "status": "affected",
              "version": "2.5.0 to 2.5.2"
            },
            {
              "status": "affected",
              "version": "2.6.0 to 2.6.4"
            },
            {
              "status": "affected",
              "version": "3.0.0-alpha"
            },
            {
              "status": "affected",
              "version": "3.0.0-alpha2"
            },
            {
              "status": "affected",
              "version": "3.0.0-beta"
            },
            {
              "status": "affected",
              "version": "3.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-24T21:15:16.767",
  "references": [
    {
      "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries."
    },
    {
      "lang": "es",
      "value": "Kylin presenta algunas apis restful que concatenarán los SQL con la cadena de entrada del usuario, es probable que un usuario sea capaz de ejecutar consultas maliciosas de la base de datos."
    }
  ],
  "lastModified": "2026-06-17T03:02:39.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "656B4A80-45A1-4F86-B7C9-349647BEC04C",
              "versionEndIncluding": "2.3.2",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E99A6DB5-2EC4-4587-B8FF-5A252AC94724",
              "versionEndIncluding": "2.4.1",
              "versionStartIncluding": "2.4.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAEF2809-48A1-4CE3-B840-252F138A21CD",
              "versionEndIncluding": "2.5.2",
              "versionStartIncluding": "2.5.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CC9157A-8552-44A4-828B-F0327E97203D",
              "versionEndIncluding": "2.6.4",
              "versionStartIncluding": "2.6.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E602D518-53D4-4259-8A9C-443249654004"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6ABDFCF-11C3-46BC-8CB2-58BE2CEAC1B5"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E21E9E3-C9B8-4313-8FD2-99DA1C6833D6"
            },
            {
              "criteria": "cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1950EE02-DCE7-4F08-8F4B-55AD8522762C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}