CVE-2020-13926
Critical
Description
Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Kylin
PublishedJul 14, 2020
First seenJul 14, 2020
How to fix
Update
- apache kylin3.1.0 or later
- org.apache.kylin:kylin-server-base3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache kylin | 2.0.0 ≤ v < 3.1.0 | 3.1.0 |
| org.apache.kylin:kylin-server-baseMaven | v < 3.1.0 | 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.