kylinGHSA-f5q9-j9r2-34gq

Apache Kylin vulnerable to Command injection by Useless configuration

CVE-2022-43396 · Published Dec 30, 2022 · updated Apr 11, 2025

High8.8

Fix: upgrade to 4.0.3 or later

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

Affected versions

Package	Affected	Fixed in
org.apache.kylin:kylin Maven	>= 2.0.0, < 4.0.3	4.0.3

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-184, CWE-77
Also known as: CVE-2022-43396

More kylin advisories

All kylin

Medium 5.3Feb 10, 2022

Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1 High 7.5Jan 8, 2022

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any originCVE-2021-45457fixed in 3.1.3 +1 High 7.5Jan 8, 2022

Use of Hard-coded Credentials in Apache KylinCVE-2021-45458fixed in 3.1.3 +1 Medium 6.5Jan 8, 2022

SQL Injection in Apache KylinCVE-2021-36774fixed in 3.1.3 MediumJan 8, 2022

Server-Side Request Forgery in Apache KylinCVE-2021-27738fixed in 3.1.3 MediumJan 8, 2022

Kylin can receive user input and load any class through Class.forName(...)CVE-2021-31522fixed in 3.1.3 +1