Apache Kylin vulnerable to Command injection by Diagnosis Controller

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-44621 · ADVISORY
• apache/kylin#2011 · WEB
• apache/kylin#2011 · WEB
• apache/kylin commit fd2977e · WEB
• apache/kylin · PACKAGE
• lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34 · WEB

Lỗ hổng khác của org.apache.kylin:kylin-server-base

• CVE-2022-24697NGHIÊM TRỌNG 9.8Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu…
• CVE-2020-13926NGHIÊM TRỌNG 9.8Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configura…
• CVE-2020-13925NGHIÊM TRỌNG 9.8Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the se…
• CVE-2020-1937CAO 8.8Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database qu…