CRITICAL🇵🇱 Wersja polska

CVE-2021-45456

CVSS 9.8v3.1pub. 2022-01-06upd. 2024-11-21

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Kylin

    APP
    Apache
    4.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-62392CRITICAL9.8PL ✓same product

OS Command Injection w Apache Kylin — nieautoryzowane wykonanie poleceń

CVE-2024-23590CRITICAL9.1PL ✓same product

Session Fixation w Apache Kylin — przejęcie sesji użytkownika

CVE-2022-44621CRITICAL9.8PL ✓same product

Apache Kylin — command injection w Diagnosis Controller via HTTP

CVE-2022-24697CRITICAL9.8PL ✓same product

Apache Kylin — Command Injection w funkcji projektanta kostek (RCE)

CVE-2021-31522CRITICAL9.8PL ✓same product

Apache Kylin — dynamiczne ładowanie klas przez niezaufane dane wejściowe