CVE-2022-44621

2022-12-3011:15:10

CWE-77

[email protected]

web.nvd.nist.gov

cve-2022-44621

diagnosis controller

parameter validation

command injection

http request

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

JSON

Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.

CPE configuration

Vulners

NVD

apachekylinRange≤4.0.2

CPENameOperatorVersion
apache:kylinapache kylinlt4.0.3

CPE	Name	Operator	Version
apache:kylin	apache kylin	lt	4.0.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Kylin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.0.2",
        "status": "affected",
        "version": "Apache Kylin 4 ",
        "versionType": "semver"
      }
    ]
  }
]