CVE-2020-13925 in the critical feed json
Command Injection in Kylin
published 2020-07-14 6 y ago modified 2026-06-17 4 mo ago also GHSA-qwfw-gxx2-mmv2 , EUVD-2020-0569
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 20.0%
- EPSS 20.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
Patch / fix
- maven org.apache.kylin:kylin-server-base 3.1.0
- apache kylin 3.1.0
Exploit prediction
20.01% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.kylin:kylin-server-base | <3.1.0 |
3.1.0 |
Affected products
- n/a Apache Kylin
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
lists.apache.org
/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E
web, mailing-list, vendor-advisory
-
lists.apache.org
/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2020-13925
advisory
-
lists.apache.org
/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E
web
-
snyk.io
/vuln/SNYK-JAVA-ORGAPACHEKYLIN-584373
web
Sources
- CVE List CVE-2020-13925
- GitHub Advisory GHSA-qwfw-gxx2-mmv2
- NVD CVE-2020-13925
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.