kylinGHSA-5429-pjww-7675
SQL Injection in Apache Kylin
Medium6.5CVE-2021-36774 · Published Jan 8, 2022 · updated Feb 16, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | < 3.1.3 | 3.1.3 |
Details and references
Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
More kylin advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 82022 | Command Injection in Apache Kylin CVE-2021-45456Mediumfixed in 4.0.1 | Medium | 4.0.1 |
| Jan 82022 | Kylin can receive user input and load any class through Class.forName(...). CVE-2021-31522Mediumfixed in 3.1.3, 4.0.1 | Medium | 3.1.3, 4.0.1 |
| Jan 82022 | Server-Side Request Forgery in Apache Kylin CVE-2021-27738Mediumfixed in 3.1.3 | Medium | 3.1.3 |
| Jan 82022 | Use of Hard-coded Credentials in Apache Kylin CVE-2021-45458High7.5fixed in 3.1.3, 4.0.1 | High7.5 | 3.1.3, 4.0.1 |
| Jan 82022 | In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. CVE-2021-45457High7.5fixed in 3.1.3, 4.0.1 | High7.5 | 3.1.3, 4.0.1 |
| Feb 102022 | Authentication bypass in Apache Kylin CVE-2020-13937Medium5.3fixed in 3.1.1, 4.0.0-beta | Medium5.3 | 3.1.1, 4.0.0-beta |