1. Home
  2. CVE Database
  3. CVE-2020-13925
CRITICAL · 9.8

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validati...

Vulnerability Description

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ApacheKylin>= 2.3.0, < 3.1.0

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2020-13925?

CVE-2020-13925 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validati...

How severe is CVE-2020-13925?

CVE-2020-13925 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-13925?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Kylin.