Tracker / CVE-2020-1937
CVE-2020-1937
High 8.8
Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
Affected products and versions
| apache | kylin |
|---|---|
| apache | kylin · 2.3.0 → 2.3.2 |
| apache | kylin · 2.4.0 → 2.4.1 |
| apache | kylin · 2.5.0 → 2.5.2 |
| apache | kylin · 2.6.0 → 2.6.4 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.