8.8Yüksek
KEV
CVE-2020-1956Apache Kylin OS Command Injection Vulnerability
Aktif olarak istismar ediliyor — Apache Kylin OS Command Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.04.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-1956
Açıklama
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Zayıflık türü (CWE):
CWE-78
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kyli… Mailing ListMitigationVendor Advisory
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706 ExploitThird Party Advisory
- [kylin-user] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
- [kylin-dev] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
- [kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml mailing-listMailing ListPatch
- [announce] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
- [oss-security] 20200714 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability mailing-listMailing List
- [kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml mailing-listMailing ListPatch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956 Third Party AdvisoryUS Government Resource
CPE eşleşmeleri (NVD) (10)
cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*≥ 2.3.0 ≤ 2.3.2cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*≥ 2.5.0 ≤ 2.5.2cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*≥ 2.6.0 ≤ 2.6.5cpe:2.3:a:apache:kylin:2.4.0:*:*:*:*:*:*:*cpe:2.3:a:apache:kylin:2.4.1:*:*:*:*:*:*:*cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:*cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:*cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:*cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:*cpe:2.3:a:apache:kylin:3.0.1:*:*:*:*:*:*:*