CVE-2020-13937

The vulnerability is an information disclosure flaw in Apache Kylin's REST API. Specifically, a RESTful endpoint exposes the application's configuration information without requiring any authentication, allowing any remote attacker to access sensitive configuration entries [1].

Exploitation requires no authentication or special privileges. An attacker can simply send a request to the vulnerable API endpoint over the network, making the attack surface broad as the endpoint is accessible to anyone who can reach the Kylin server [1].

The impact is the disclosure of confidential configuration information, which may include database credentials, encryption keys, or other sensitive settings that could be leveraged for further attacks. The exposure of such data can lead to a complete compromise of the Kylin instance and associated systems [1].

The vulnerability affects a wide range of Apache Kylin versions from 2.0.0 through 4.0.0-alpha. Users should upgrade to a patched version as soon as possible; no workarounds are mentioned in the available reference [1].