Description
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Kylin | Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
yaunsky/CVE-2020-13937 ★ 9 · Jan 15, 2021
Apache Kylin API未授权访问漏洞;CVE-2020-13937;Apache Kylin漏洞
-
Al1ex/CVE-2020-13937 ★ 5 · Jan 22, 2021
Apache Kylin API Unauthorized Access
-
kailing0220/CVE-2020-13937 ★ 1 · Oct 18, 2022
Apache Kylin有一个restful api会在没有任何认证的情况下暴露配置信息
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Kylin - Exposed Configuration File http/cves/2020/CVE-2020-13937.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.kylin:kylin | < 3.1.1 | 3.1.1 | GHSA-2hpg-vwqj-6h6w |
| Maven | org.apache.kylin:kylin | >= 4.0.0-alpha, < 4.0.0-beta | 4.0.0-beta | GHSA-2hpg-vwqj-6h6w |