CVE-2022-43396 Apache Kylin: Command injection by Useless configuration

2022-12-3010:30:45

apache

www.cve.org

cve-2022-43396; apache kylin; command injection; risk; configuration; bypass; user input; parameter control; spark-cmd

9.5 High

AI Score

Confidence

High

0.041 Low

EPSS

Percentile

92.2%

JSON

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Kylin",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.0.2",
        "status": "affected",
        "version": "Apache Kylin 4",
        "versionType": "semver"
      }
    ]
  }
]