Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-8ye7-t531-b7hw

Summary

Insecure Storage of Sensitive Information
Apache Kylin has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.

Aliases

alias	CVE-2020-13937

alias	GHSA-2hpg-vwqj-6h6w

Fixed_packages

url pkg:maven/org.apache.kylin/kylin@3.0.0-alpha

purl pkg:maven/org.apache.kylin/kylin@3.0.0-alpha

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@3.0.0-alpha

url	pkg:maven/org.apache.kylin/kylin@3.1.1
purl	pkg:maven/org.apache.kylin/kylin@3.1.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@3.1.1

url	pkg:maven/org.apache.kylin/kylin@4.0.0-beta
purl	pkg:maven/org.apache.kylin/kylin@4.0.0-beta
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@4.0.0-beta

url	pkg:maven/org.apache.kylin/kylin@4.0.1
purl	pkg:maven/org.apache.kylin/kylin@4.0.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@4.0.1

Affected_packages

url pkg:maven/org.apache.kylin/kylin@2.1.0

purl pkg:maven/org.apache.kylin/kylin@2.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.1.0

url pkg:maven/org.apache.kylin/kylin@2.2.0

purl pkg:maven/org.apache.kylin/kylin@2.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.2.0

url pkg:maven/org.apache.kylin/kylin@2.3.1

purl pkg:maven/org.apache.kylin/kylin@2.3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.3.1

url pkg:maven/org.apache.kylin/kylin@2.5.1

purl pkg:maven/org.apache.kylin/kylin@2.5.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.5.1

url pkg:maven/org.apache.kylin/kylin@2.6.1

purl pkg:maven/org.apache.kylin/kylin@2.6.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.1

url pkg:maven/org.apache.kylin/kylin@2.6.2

purl pkg:maven/org.apache.kylin/kylin@2.6.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.2

url pkg:maven/org.apache.kylin/kylin@2.6.3

purl pkg:maven/org.apache.kylin/kylin@2.6.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.3

url pkg:maven/org.apache.kylin/kylin@2.0.0

purl pkg:maven/org.apache.kylin/kylin@2.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2mp1-7zce-dkh8

vulnerability	VCID-8v1x-1x2n-vbhu

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-pjr6-y7uu-jqfd

vulnerability	VCID-qvy9-qe44-kbf1

vulnerability	VCID-sz6c-t8m7-z3dj

vulnerability	VCID-x2j7-1kq5-e3ec

vulnerability	VCID-ygvg-2wzv-nubj

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.0.0

url pkg:maven/org.apache.kylin/kylin@2.3.0

purl pkg:maven/org.apache.kylin/kylin@2.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.3.0

url pkg:maven/org.apache.kylin/kylin@2.3.2

purl pkg:maven/org.apache.kylin/kylin@2.3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.3.2

url pkg:maven/org.apache.kylin/kylin@2.4.0

purl pkg:maven/org.apache.kylin/kylin@2.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.4.0

url pkg:maven/org.apache.kylin/kylin@2.4.1

purl pkg:maven/org.apache.kylin/kylin@2.4.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.4.1

url pkg:maven/org.apache.kylin/kylin@2.5.0

purl pkg:maven/org.apache.kylin/kylin@2.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.5.0

url pkg:maven/org.apache.kylin/kylin@2.5.2

purl pkg:maven/org.apache.kylin/kylin@2.5.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.5.2

url pkg:maven/org.apache.kylin/kylin@2.6.0

purl pkg:maven/org.apache.kylin/kylin@2.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.0

url pkg:maven/org.apache.kylin/kylin@2.6.4

purl pkg:maven/org.apache.kylin/kylin@2.6.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.4

url pkg:maven/org.apache.kylin/kylin@2.6.5

purl pkg:maven/org.apache.kylin/kylin@2.6.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.5

url pkg:maven/org.apache.kylin/kylin@2.6.6

purl pkg:maven/org.apache.kylin/kylin@2.6.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8v1x-1x2n-vbhu

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-pjr6-y7uu-jqfd

vulnerability	VCID-qvy9-qe44-kbf1

vulnerability	VCID-sz6c-t8m7-z3dj

vulnerability	VCID-x2j7-1kq5-e3ec

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@2.6.6

url pkg:maven/org.apache.kylin/kylin@3.0.0

purl pkg:maven/org.apache.kylin/kylin@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-3tdp-fpt7-mycx

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8v1x-1x2n-vbhu

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-cret-1sa1-8kd6

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-pjr6-y7uu-jqfd

vulnerability	VCID-qvy9-qe44-kbf1

vulnerability	VCID-sz6c-t8m7-z3dj

vulnerability	VCID-x2j7-1kq5-e3ec

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@3.0.0

url pkg:maven/org.apache.kylin/kylin@3.0.1

purl pkg:maven/org.apache.kylin/kylin@3.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ssr-ftym-kubw

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@3.0.1

url pkg:maven/org.apache.kylin/kylin@3.0.2

purl pkg:maven/org.apache.kylin/kylin@3.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-jy58-3kzh-xfbz

vulnerability	VCID-qvy9-qe44-kbf1

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@3.0.2

url pkg:maven/org.apache.kylin/kylin@3.1.0

purl pkg:maven/org.apache.kylin/kylin@3.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ye7-t531-b7hw

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@3.1.0

url pkg:maven/org.apache.kylin/kylin@4.0.0-alpha

purl pkg:maven/org.apache.kylin/kylin@4.0.0-alpha

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-8ye7-t531-b7hw

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@4.0.0-alpha

url pkg:maven/org.apache.kylin/kylin@4.0.0

purl pkg:maven/org.apache.kylin/kylin@4.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5h7z-8j2q-k3hk

vulnerability	VCID-74vu-bu5d-zqgq

vulnerability	VCID-8v1x-1x2n-vbhu

vulnerability	VCID-8ye7-t531-b7hw

vulnerability	VCID-dzkm-q626-pug7

vulnerability	VCID-m89c-z84y-jug2

vulnerability	VCID-pjr6-y7uu-jqfd

vulnerability	VCID-w2x3-2b5w-mbb7

vulnerability	VCID-x2j7-1kq5-e3ec

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin@4.0.0

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2020-13937

reference_id

reference_type

scores

value	0.93332
scoring_system	epss
scoring_elements	0.9982
published_at	2026-06-04T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2020-13937

reference_url

https://lists.apache.org/thread.html/rc592e0dcee5a2615f1d9522af30ef1822c1f863d5e05e7da9d1e57f4%40%3Cuser.kylin.apache.org%3E

reference_id

reference_type

scores

value	5.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://lists.apache.org/thread.html/rc592e0dcee5a2615f1d9522af30ef1822c1f863d5e05e7da9d1e57f4%40%3Cuser.kylin.apache.org%3E

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2020-13937

reference_id

CVE-2020-13937

reference_type

scores

value	5.3
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2020-13937

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	922
name	Insecure Storage of Sensitive Information
description	The product stores sensitive information without properly limiting read or write access by unauthorized actors.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score 4.0 - 6.9

Exploitability 0.5

Weighted_severity 6.2

Risk_score 3.1

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8ye7-t531-b7hw

Vulnerability Instance