CVE-2020-1956

nvd nist nuclei

Published: May 22, 2020Modified: Jun 17, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Affected (10)

Products: Apache: Kylin

1 product

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Apache Kylin	2.3.0 ≤ version ≤ 2.3.2
Apache Kylin	2.5.0 ≤ version ≤ 2.5.2
Apache Kylin	2.6.0 ≤ version ≤ 2.6.5
Apache Kylin	Version 2.4.0
Apache Kylin	Version 2.4.1
Apache Kylin	Version 3.0.0
Apache Kylin	Version 3.0.0 alpha2
Apache Kylin	Version 3.0.0 alpha
Apache Kylin	Version 3.0.0 beta
Apache Kylin	Version 3.0.1

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (17)

http://www.openwall.com/lists/oss-security/2020/07/14/1

Source: security@apache.org

Mailing List

https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706

Source: security@apache.org

ExploitThird Party Advisory

https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E

Source: security@apache.org

Mailing ListPatch

https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E

Source: security@apache.org

Mailing ListMitigationVendor Advisory

https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E

Source: security@apache.org

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2020/07/14/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListMitigationVendor Advisory

https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.