Intrusion PreventionApache.Kylin.REST.API.DiagnosisService.Command.Injection
Description
This indicates an attack attempt to exploit a Command Injection Vulnerability in Apache Software Foundation Kylin.
The vulnerability is due to insufficient validation of user-supplied input to the diag REST API endpoint. A remote, authenticated attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the target server. Successful exploitation of this vulnerability can lead to arbitrary code execution in the context of user running the application.
Affected Products
Apache Software Foundation Kylin prior to 3.1.0
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://kylin.apache.org/docs/security.html
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 49377 |
| Created | Jul 28, 2020 |
| Updated | Sep 23, 2020 |
| Risk |
|
| CVE ID | CVE-2020-13925 |
| Exploit Prediction Score | 0.45% |
| Default Action | drop |
| Active | |
| Affected OS | All |
| Affected App | Apache |