CVE-2020-13926

Description

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

3.106

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-13926,CVE-2020-13925 are fixed in Apache-kylin-server-base 3.1.0	Windows
Vulnerabilities CVE-2020-13926,CVE-2020-13925 are fixed in Apache-kylin-server-base for Linux 3.1.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234