Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1956
Reference (s):
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E
- MLIST:[announce] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability
- URL: https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb@%3Cannounce.apache.org%3E
- MLIST:[kylin-commits] 20200713 svn commit: r1879845 – in /kylin/site: docs/security.html feed.xml