CVE-2020-1956

Timeline

Detection, updates, and resolution for this record.

1. May 22, 2020 · Catalog

   Detected

   Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

2. Mar 25, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 15, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Affected

• cpe apache/kylinversion unspecified
• cpe apache/kylin2.4.0
• cpe apache/kylin2.4.1
• cpe apache/kylin3.0.0
• vendor Apache Kylinversion unspecified

Sources

• CISA KEVCVE-2020-1956

  Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.

  cisa.gov
• CVE.orgCVE-2020-1956

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2020-1956

  30-day exploitation probability 97.3%

  first.org
• NIST NVDCVE-2020-1956

  Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

  nvd.nist.gov

References

• Mailing List · openwall.com
• Exploit · community.sonarsource.com
• Mailing List · lists.apache.org
• Mailing List · lists.apache.org
• Mailing List · lists.apache.org
• Mailing List · lists.apache.org
• Mailing List · lists.apache.org
• CISA note · nvd.nist.gov