CVE-2020-13925: OS Command Injection

July 14, 2020 (updated July 21, 2020)

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely.

References

nvd.nist.gov/vuln/detail/CVE-2020-13925

Code Behaviors & Features

Detect and mitigate CVE-2020-13925 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →