Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2020-1956GHSA-GPRM-XQRC-C2J3

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a

Published
Last modified
published
Listed in CISA KEV
Fix
Fixed in 2.6.6, 3.0.2
None on Exploit-DB, Metasploit or GitHub

Summary

Apache Kylin, an open-source analytics platform for big data, is affected through some of its REST APIs that build operating system commands by directly joining user-supplied input into them. An attacker who can reach these APIs could likely run arbitrary operating system commands on the server without any validation or protection.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Kylin

    through 2.6.5; through 3.0.1

  • org.apache.kylin:kylin-core-commonMaven

    fixed in 2.6.6

  • org.apache.kylin:kylin-core-commonMaven

    From 3.0.0 · fixed in 3.0.2

References 8

lists.apache.org

community.sonarsource.com

openwall.com