CVE-2020-13925: 
Java vulnerability analysis and mitigation

Apache Kylin, versions 2.3.0 to 3.1.0, contains a command injection vulnerability identified as CVE-2020-13925. The vulnerability was discovered and disclosed on July 14, 2020. Similar to a previous vulnerability (CVE-2020-1956), this issue exists in a RESTful API that concatenates API inputs into OS commands and executes them on the server without proper input validation (NVD).

The vulnerability is classified as an OS Command Injection (CWE-78) where the RESTful API lacks necessary input validation mechanisms. The severity of this vulnerability is rated as CRITICAL with a CVSS v3.1 Base Score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v2.0 score of 10.0 (Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C) (NVD).

The vulnerability allows attackers to execute arbitrary OS commands remotely on the affected server. This could lead to complete system compromise, including unauthorized access to sensitive data, system modification, and potential service disruption (NVD).

The vulnerability is considered highly exploitable due to its network accessibility (AV:N) and low attack complexity (AC:L). No special privileges or user interaction are required to exploit this vulnerability (NVD).

Users of all versions after 2.3.0 are advised to upgrade to Apache Kylin version 3.1.0 or later to address this vulnerability (CVE Details).