cve.bz

CVE-2020-1956

8.8 highKEVEPSS 97%

High (8.8) in Apache Kylin. In CISA KEV since 2022-03-25. EPSS 97% chance of exploitation in the next 30 days. Fixed in org.apache.kylin:kylin-core-common 2.6.6, 3.0.2.

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
97% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2022-03-25, due 2022-04-15
CWE
CWE-78
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-gprm-xqrc-c2j3Mavenorg.apache.kylin:kylin-core-common<2.6.62.6.6
GHSA-gprm-xqrc-c2j3Mavenorg.apache.kylin:kylin-core-common>=3.0.0 <3.0.23.0.2

References

Check your stackJSON