exploitDog

CVE-2026-62390

Опубликовано: 14 июл. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL.

This issue affects Apache Kylin: from 4 through 5.0.3.

Users are recommended to upgrade to version 5.0.4, which fixes the issue.

Ссылки

https://lists.apache.org/thread/zdrj93txvdjj07f88s43d2pcg2gomvjc
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/14/4
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 5.0.4 (исключая)

EPSS

Процентиль: 34%

0.00409

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-92vx-x7gx-68cf

CVSS3: 9.8

github

29 дней назад

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

EPSS

Процентиль: 34%

0.00409

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89