CVE-2022-43396

2022-12-3011:15:10

[email protected]

web.nvd.nist.gov

cve-2022-43396

security

filtering

bypass

user input

risk

command control

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

JSON

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

CPE configuration

Vulners

NVD

apachekylinRange≤4.0.2

CPENameOperatorVersion
apache:kylinapache kylinlt4.0.3

CPE	Name	Operator	Version
apache:kylin	apache kylin	lt	4.0.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Kylin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.0.2",
        "status": "affected",
        "version": "Apache Kylin 4",
        "versionType": "semver"
      }
    ]
  }
]