Read the docs
TI-2020-10903 Aliases CVE-2020-13925GHSA-qwfw-gxx2-mmv2

OS command injection in Apache Kylin

Priority MEDIUM 61CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

Why it matters now

EPSS 0.20013 97th percentileScored 2026-11-07
Fix Fixed org.apache.kylin:kylin-server-base (Maven): 3.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache KylinApache Kylin 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1 3.0.2—No fix listedCNA
—org.apache.kylin:kylin-server-base (Maven)before 3.1.03.1.0Patch availableGHSA-qwfw-gxx2-mmv2
  • Apache Kylin Vendor— Affected Apache Kylin 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1 3.0.2 Fixed in — No fix listed CNA
  • org.apache.kylin:kylin-server-base (Maven) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-qwfw-gxx2-mmv2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*2.3.0 to before 3.1.0VulnerableApache
  • cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* Versions 2.3.0 to before 3.1.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-qwfw-gxx2-mmv2 org.apache.kylin:kylin-server-base (Maven) Fixed in 3.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13925
  2. 2026-10-03 Alias added: GHSA-qwfw-gxx2-mmv2

References

Advisory 2

Other 2

  • TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
  • TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
  • TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
  • TI-2025-38136 Apache Kylin: improper restriction of file read CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences