GitStock

apache/kylin · Security

Command Injection in Kylin

GHSA ID
GHSA-gprm-xqrc-c2j3
CVE ID
CVE-2020-1956
Severity
high
Published
Updated
CVSS
8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H
CVSS v3
8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H

Description

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

CWEs

  • CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References