Apache · Kylin
CVE-2020-1956
Apache Kylin OS Command Injection Vulnerability
공격에 악용됨
높음 8.8 공격 가능성: 97%
무엇인가
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
CISA: Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 4월 15일
- CISA 목록에 추가됨
- 2022년 3월 25일
- 게시됨
- 2020년 5월 22일
- 심각도
- 높음 8.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 97% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-78
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(8)
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kyli…
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kyli…
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin…
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.k…
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.…
- http://www.openwall.com/lists/oss-security/2020/07/14/1
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.k…
Apache의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 8. | Command Injection | Struts | 높음 8.1 | 97% |
| 2026. 8. 4. | Missing Encryption of Sensitive Data | Tomcat | 높음 7.5 | 99% |
| 2026. 4. 16. | Improper Input Validation | ActiveMQ | 높음 8.8 | 98% |
| 2025. 5. 1. | Improper Escaping of Output | HTTP Server | 치명적 9.1 | >99.9% |
| 2025. 4. 1. | Path Equivalence | Tomcat | 치명적 10.0 | 99.9% |
| 2025. 2. 4. | Forced Browsing | OFBiz | 치명적 9.8 | >99.9% |
| 2024. 9. 18. | Improper Access Control | HugeGraph-Server | 치명적 9.8 | 99.2% |
| 2024. 8. 27. | Incorrect Authorization | OFBiz | 높음 8.1 | 99.4% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.