Advisoriesby IbiskylinGHSA-hw3m-8h25-8frw
Command Injection in Apache Kylin
Fix: upgrade to 4.0.1 or later
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | < 4.0.1 | 4.0.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-77
- Also known as
- CVE-2021-45456
More kylin advisories
All kylin
Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any originCVE-2021-45457fixed in 3.1.3 +1Use of Hard-coded Credentials in Apache KylinCVE-2021-45458fixed in 3.1.3 +1SQL Injection in Apache KylinCVE-2021-36774fixed in 3.1.3Server-Side Request Forgery in Apache KylinCVE-2021-27738fixed in 3.1.3Kylin can receive user input and load any class through Class.forName(...)CVE-2021-31522fixed in 3.1.3 +1