CyberSec.Space Logo
Back to CVE Browser

CVE-2020-1956

Known Exploited (CISA KEV)HIGH
8.8
CVSS Severity Score
EPSS Score39.2000%
EPSS Percentile98.21th
PublishedMay 22, 2020
Last ModifiedOct 23, 2025

Vulnerability Description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Affected Platforms (CPE)

📦
Apache

Kylin

>= 2.3.0 and <= 2.3.2
📦
Apache

Kylin

>= 2.5.0 and <= 2.5.2
📦
Apache

Kylin

>= 2.6.0 and <= 2.6.5
📦
Apache

Kylin

= 2.4.0
📦
Apache

Kylin

= 2.4.1
📦
Apache

Kylin

= 3.0.0
📦
Apache

Kylin

= 3.0.0
📦
Apache

Kylin

= 3.0.0
📦
Apache

Kylin

= 3.0.0
📦
Apache

Kylin

= 3.0.1

References & Advisories

🔗 http://www.openwall.com/lists/oss-security/2020/07/14/1
🔗 https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
🔗 https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
🔗 https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E
🔗 https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E
🔗 https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E
🔗 https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E
🔗 https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E

Related Vulnerabilities

CVE-2021-315229.8

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and pr...

CVE-2020-139269.8

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system...

CVE-2020-139259.8

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them...

CVE-2021-454569.8

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. Ther...