Vulnerability · Published Oct 13, 2022 · Assigned by apache
CVE-2022-24697Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
Critical 9.8
In plain English
A critical-severity OS command injection in Apache Kylin from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 84.8% (higher than 99.7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.kylin:kylin-core-common | 4.0.2 | GHSA-ppxx-m926-g569 |
| Maven | org.apache.kylin:kylin-server-base | 4.0.2 | GHSA-ppxx-m926-g569 |
| Maven | org.apache.kylin:kylin-spark-project | 4.0.2 | GHSA-ppxx-m926-g569 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Kylin | Apache Kylin 2 – before 2.6.6Apache Kylin 3 – through 3.1.2Apache Kylin 4 – through 4.0.1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H