{"containers": {"cna": {"affected": [{"product": "Apache Kylin", "vendor": "Apache", "versions": [{"status": "affected", "version": "ApacheKylin 2.3.0 to 2.3.2"}, {"status": "affected", "version": "2.4.0 to 2.4.1"}, {"status": "affected", "version": "2.5.0 to 2.5.2"}, {"status": "affected", "version": "2.6.0 to 2.6.4"}, {"status": "affected", "version": "3.0.0-alpha"}, {"status": "affected", "version": "3.0.0-alpha2"}, {"status": "affected", "version": "3.0.0-beta"}, {"status": "affected", "version": "3.0.0"}]}], "descriptions": [{"lang": "en", "value": "Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries."}], "problemTypes": [{"descriptions": [{"description": "SQL injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-07-15T09:06:06", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "[kylin-user] 20200223 [CVE-2020-1937] Apache Kylin SQL injection vulnerability", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E"}, {"name": "[kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E"}, {"name": "[kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2020-1937", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Kylin", "version": {"version_data": [{"version_value": "ApacheKylin 2.3.0 to 2.3.2"}, {"version_value": "2.4.0 to 2.4.1"}, {"version_value": "2.5.0 to 2.5.2"}, {"version_value": "2.6.0 to 2.6.4"}, {"version_value": "3.0.0-alpha"}, {"version_value": "3.0.0-alpha2"}, {"version_value": "3.0.0-beta"}, {"version_value": "3.0.0"}]}}]}, "vendor_name": "Apache"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "SQL injection"}]}]}, "references": {"reference_data": [{"name": "[kylin-user] 20200223 [CVE-2020-1937] Apache Kylin SQL injection vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E"}, {"name": "[kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0@%3Ccommits.kylin.apache.org%3E"}, {"name": "[kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:53:59.800Z"}, "title": "CVE Program Container", "references": [{"name": "[kylin-user] 20200223 [CVE-2020-1937] Apache Kylin SQL injection vulnerability", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E"}, {"name": "[kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E"}, {"name": "[kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2020-1937", "datePublished": "2020-02-24T20:57:52", "dateReserved": "2019-12-02T00:00:00", "dateUpdated": "2024-08-04T06:53:59.800Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "matchCriteriaId": "656B4A80-45A1-4F86-B7C9-349647BEC04C", "versionEndIncluding": "2.3.2", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "matchCriteriaId": "E99A6DB5-2EC4-4587-B8FF-5A252AC94724", "versionEndIncluding": "2.4.1", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAEF2809-48A1-4CE3-B840-252F138A21CD", "versionEndIncluding": "2.5.2", "versionStartIncluding": "2.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CC9157A-8552-44A4-828B-F0327E97203D", "versionEndIncluding": "2.6.4", "versionStartIncluding": "2.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "E602D518-53D4-4259-8A9C-443249654004", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:*", "matchCriteriaId": "E6ABDFCF-11C3-46BC-8CB2-58BE2CEAC1B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "8E21E9E3-C9B8-4313-8FD2-99DA1C6833D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:*", "matchCriteriaId": "1950EE02-DCE7-4F08-8F4B-55AD8522762C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries."}, {"lang": "es", "value": "Kylin presenta algunas apis restful que concatenar\u00e1n los SQL con la cadena de entrada del usuario, es probable que un usuario sea capaz de ejecutar consultas maliciosas de la base de datos."}], "id": "CVE-2020-1937", "lastModified": "2024-11-21T05:11:39.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-24T21:15:16.767", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread.html/rc574fef23740522f62ab3bbda4f6171be98aa7a25f3f54be143a80a8%40%3Cuser.kylin.apache.org%3E"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}