CVE-2020-13925

CVE-2020-13925 Environment Setup Refer to https://github.com/apache/kylin to deploy using Docker, and change the version to 3.0.1 the vulnerable version. You can remove -m 8G \ it controls the allocated memory size. Then visit http://host:7070/kylin/login. The default username and password are...

CVE-2020-13925

creationtimestamp| type| source ---|---|--- 2026-09-04 18:00:04+00:00| seen| Telegram/DGzHuk8RVb1b8Xt8Ti7JrWo03tk4z5tw950ouDC7Dv-DN4 2026-09-05 01:00:20+00:00| published-proof-of-concept| Telegram/DGzHuk8RVb1b8Xt8Ti7JrWo03tk4z5tw950ouDC7Dv-DN4...

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...

Apache Kylin Command Injection (CVE-2020-13925)

A command injection vulnerability exists in Apache kylin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

org.apache.kylin:kylin-tool-assembly (2.4.0) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.4.0)

org.apache.kylin:kylin-server-base MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.4.0 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.3.2) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.3.2)

org.apache.kylin:kylin-server-base MAVEN version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.3.2 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.6.5) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.6.5)

org.apache.kylin:kylin-server-base MAVEN version 2.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.5 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.5.1) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.5.1)

org.apache.kylin:kylin-server-base MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.5.1 Source cves: CVE-2020-13925 Source advisory:...

CVE-2020-13925

CVE-2020-13925 is a Kylin REST API command injection issue affecting 2.3.x through 3.1.0. The root cause is REST endpoints concatenating user input into OS commands, enabling remote command execution on vulnerable servers. The CVE is linked to CVE-2020-1956 disclosures describing similar REST‑bas...

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...