⚠ Actively exploited
Added to CISA KEV on 2022-03-25. Federal agencies required to patch by 2022-04-15. Required action: Apply updates per vendor instructions..

CVE-2020-1956 — OS Command Injection in Apache Kylin

CWE-78 — OS Command Injection9 documents8 sources
Severity
8.8HIGHNVD
EPSS
93.9%
top 0.13%
CISA KEV
KEV
Added 2022-03-25
Due 2022-04-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Apache Kylin
Timeline
PublishedMay 22
KEV addedMar 25
KEV dueApr 15
CISA Required Action: Apply updates per vendor instructions.

Description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/kylin2.3.0 — 2.3.2+6
▶CVEListV5apache/kylin2.3.0, <=2.6.5, <=3.0.1+2

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

5
OSV
Command Injection in Kylin↗2020-07-27
▶
GHSA
Command Injection in Kylin↗2020-07-27
▶
GHSA
Command Injection in Kylin↗2020-07-27
▶
CVEList
CVE-2020-1956: Apache Kylin 2↗2020-05-22
▶
VulnCheck
Apache Kylin OS Command Injection Vulnerability↗2020
▶

💥Exploits & PoCs

1
Nuclei
Apache Kylin 3.0.1 - Command Injection Vulnerability
▶

📋Vendor Advisories

1
CISA
Apache Kylin OS Command Injection Vulnerability↗2022-03-25
▶

💬Community

1
Bugzilla
CVE-2020-2254 jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read arbitrary files↗2020-09-18
▶
CVE-2020-1956 — OS Command Injection in Apache Kylin | cvebase