CRITICAL🇵🇱 Wersja polska

CVE-2020-13925

CVSS 9.8v3.1pub. 2020-07-14upd. 2024-11-21

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Kylin

    APP
    Apache
    2.3.0 – 3.1.0 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2024-23590CRITICAL9.1PL ✓ten sam produkt

Session Fixation w Apache Kylin — przejęcie sesji użytkownika

CVE-2022-44621CRITICAL9.8ten sam produkt

Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.

CVE-2022-24697CRITICAL9.8ten sam produkt

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the...

CVE-2021-31522CRITICAL9.8ten sam produkt

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 ...

CVE-2021-45456CRITICAL9.8ten sam produkt

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed ...