CVE-2020-13925

CVE-2020-13925 環境構築 参考 https://github.com/apache/kylin を使用し、dockerで環境をデプロイします。バージョンを3.0.1（脆弱性のあるバージョン）に変更します。【-m 8G \ 】はメモリサイズを割り当てるためのものなので、削除しても構いません。 その後 http://host:7070/kylin/login にアクセスします。初期ユーザー名とパスワードは ADMIN/KYLIN です。 root@kitploit: docker pull apachekylin/apache-kylin-standalone:3.0.1...

CVE-2020-13925

creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:04+00:00| seen| Telegram/DGzHuk8RVb1b8Xt8Ti7JrWo03tk4z5tw950ouDC7Dv-DN4 2026-09-05 01:00:20+00:00| published-proof-of-concept| Telegram/DGzHuk8RVb1b8Xt8Ti7JrWo03tk4z5tw950ouDC7Dv-DN4...

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...

Apache Kylin Command Injection (CVE-2020-13925)

A command injection vulnerability exists in Apache kylin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...

CVE-2020-13925

CVE-2020-13925 is a Kylin REST API command injection issue affecting 2.3.x through 3.1.0. The root cause is REST endpoints concatenating user input into OS commands, enabling remote command execution on vulnerable servers. The CVE is linked to CVE-2020-1956 disclosures describing similar REST‑bas...