8.8
High
CVE-2020-1956 Apache Kylin OS Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-78
Description
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.