SQL Injection in Apache Kylin
CVE-2020-13926
Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
Vulnerability class: SQL Injection
EPSS: 0.019 (78.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Kylin
- N/a Apache Kylin — versions Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1 3.0.2
Weakness classification (CWE)
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2020-13926?
- CVE-2020-13926 is a critical-severity vulnerability in Apache Kylin, classified under SQL Injection. CVSS score: 9.8/10. Published 2020-07-14.
- How severe is CVE-2020-13926?
- Critical severity. CVSS v3 base score is 9.8 out of 10.