CVE-2020-1937: SQL Injection in Kylin
Summary
CVE-2020-1937: SQL Injection in Kylin. Affects org.apache.kylin:kylin-server-base across 2 version ranges.
< 2.6.5
>= 3.0.0, < 3.0.1
Fixed in 2.6.5 or 3.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kylin is an open-source distributed analytics engine designed to provide SQL interface and multi-dimensional analysis (OLAP) on Hadoop supporting extremely large datasets. It offers RESTful APIs that allow users to interact with the system and perform various operations. However, due to improper handling of user input, a SQL injection vulnerability exists in Kylin.
Vulnerability Detail
The vulnerability in Kylin arises from the concatenation of user input strings with SQL queries in the RESTful APIs. This allows an attacker to inject malicious SQL queries, potentially leading to unauthorized access, data manipulation, or even remote code execution. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 4.0.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.52.6.5 -
>= 3.0.0, < 3.0.13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to sanitize and validate user input before concatenating it with SQL queries. Implementing parameterized queries or using prepared statements can help prevent SQL injection attacks. Here is an example of using prepared statements in Java:
String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement statement = connection.prepareStatement(sql);
statement.setString(1, username);
statement.setString(2, password);
ResultSet resultSet = statement.executeQuery();
By using prepared statements, the user input is treated as data rather than executable code, effectively mitigating the SQL injection vulnerability.
Conclusion
The SQL injection vulnerability in Kylin can pose a significant risk to the security and integrity of the system. It is crucial to promptly apply the recommended fixes by upgrading to the fixed versions. Sanitizing and validating user input is also important to mitigate the risk until the upgrade can be performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin-server-base →
FAQ
Kylin is an open-source distributed analytics engine designed for large-scale data processing and OLAP analysis on Hadoop.
The SQL injection vulnerability in Kylin can allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or remote code execution.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Kylin (2.6.5 or later for versions 2.6.5 and below, and 3.0.1 or later for versions 3.0.0 and below).
As a temporary workaround, you can sanitize and validate user input before concatenating it with SQL queries. Implementing parameterized queries or using prepared statements can help prevent SQL injection attacks.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin-server-base.
