cyfenced.com →

[ CVE-2020-1956 · Published 22 May 2020 ]

Apache Kylin OS Command Injection Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 97%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
  • EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

CISA: Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.

[ References ]References