CVE-2020-1956: apache kylin

csirt@kutim:~/threat-intel/cve/CVE-2020-1956

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 97,3%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada apache kylin. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Rincian

Terbit di NVD: 22 Mei 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 97,3% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache Kylin OS Command Injection Vulnerability
Masuk KEV: 25 Maret 2022
Tenggat CISA: 15 April 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	kylin	Versi 2.3.0 hingga 2.3.2
apache	kylin	Versi 2.5.0 hingga 2.5.2
apache	kylin	Versi 2.6.0 hingga 2.6.5
apache	kylin	Versi 2.4.0
apache	kylin	Versi 2.4.1
apache	kylin	Versi 3.0.0
apache	kylin	Versi 3.0.0 alpha
apache	kylin	Versi 3.0.0 alpha2
apache	kylin	Versi 3.0.0 beta
apache	kylin	Versi 3.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin... mailing list · mitigasi · advisory vendor
https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.ky... mailing list · patch
https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.ky... mailing list · patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956 advisory pihak ketiga · pemerintah AS
https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706 exploit · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2020/07/14/1 mailing list
https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.a... mailing list
https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.... mailing list
https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin... mailing list

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.