Insecure storage of sensitive information in Apache Kylin
Priority MEDIUM 64CWE-922Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-922.
Summary
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
Why it matters now
EPSS 0.78331 99th percentileScored 2026-11-07
Fix Fixed org.apache.kylin:kylin (Maven): 3.1.1, 4.0.0-beta
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Kylin | Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha | — | No fix listed | CNA |
| — | org.apache.kylin:kylin (Maven) | before 3.1.1 | 3.1.1 | Patch available | GHSA-2hpg-vwqj-6h6w |
| — | org.apache.kylin:kylin (Maven) | 4.0.0-alpha to before 4.0.0-beta | 4.0.0-beta | Patch available | GHSA-2hpg-vwqj-6h6w |
- Apache Kylin Vendor— Affected Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha Fixed in — No fix listed CNA
- org.apache.kylin:kylin (Maven) Vendor— Affected before 3.1.1 Fixed in 3.1.1 Patch available GHSA-2hpg-vwqj-6h6w
- org.apache.kylin:kylin (Maven) Vendor— Affected 4.0.0-alpha to before 4.0.0-beta Fixed in 4.0.0-beta Patch available GHSA-2hpg-vwqj-6h6w
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:kylin:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.3.0:*:*:*:*:*:*:* | 2.3.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.3.1:*:*:*:*:*:*:* | 2.3.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.3.2:*:*:*:*:*:*:* | 2.3.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.4.0:*:*:*:*:*:*:* | 2.4.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.4.1:*:*:*:*:*:*:* | 2.4.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.5.0:*:*:*:*:*:*:* | 2.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.5.1:*:*:*:*:*:*:* | 2.5.1 | Vulnerable | Apache |
- cpe:2.3:a:apache:kylin:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Apache
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:kylin:2.5.2:*:*:*:*:*:*:* | 2.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.1:*:*:*:*:*:*:* | 2.6.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.3:*:*:*:*:*:*:* | 2.6.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.4:*:*:*:*:*:*:* | 2.6.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.5:*:*:*:*:*:*:* | 2.6.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:2.6.6:*:*:*:*:*:*:* | 2.6.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:* | 3.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:* | 3.0.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:* | 3.0.0 alpha2 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:* | 3.0.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.0.2:*:*:*:*:*:*:* | 3.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:3.1.0:*:*:*:*:*:*:* | 3.1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:* | 4.0.0 alpha | Vulnerable | Apache |
- cpe:2.3:a:apache:kylin:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:2.6.6:*:*:*:*:*:*:* Versions 2.6.6 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.0.0:-:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.0.0:alpha:*:*:*:*:*:* Versions 3.0.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.0.0:beta:*:*:*:*:*:* Versions 3.0.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:* Versions 4.0.0 alpha Vulnerable ·Apache
Remediation
- Fix · GHSA-2hpg-vwqj-6h6w org.apache.kylin:kylin (Maven) Fixed in 3.1.1 Advisory →
- Fix · GHSA-2hpg-vwqj-6h6w org.apache.kylin:kylin (Maven) Fixed in 4.0.0-beta Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13937
- 2026-10-03 Alias added: GHSA-2hpg-vwqj-6h6w
References
More Apache Kylin vulnerabilities
- TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
- TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
- TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
- TI-2025-38136 Apache Kylin: improper restriction of file read CVSS 3.1HIGH 7.5
Sources
- CVE-2020-13937 · CVE Program
- CVE-2020-13937 · NVD
- FIRST EPSS
- GHSA-2hpg-vwqj-6h6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences