Lucene search
HistoryDec 30, 2022 - 11:15 a.m.
CVE-2022-43396
insecure command filtering
fix vulnerability
control parameter
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.046
Percentile
92.7%
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
Affected configurations
Node
apachekylinRange<4.0.3
Related
cve
cve
CVE-2022-43396
2022-12-30 11:15:10
CVE-2022-24697
2022-10-13 13:15:09
osv
osv
Apache Kylin vulnerable to Command injection by Useless configuration
2022-12-30 12:30:25
CVE-2022-43396
2022-12-30 11:15:10
CVE-2022-24697
2022-10-13 13:15:09
github
github
Apache Kylin vulnerable to Command injection by Useless configuration
2022-12-30 12:30:25
Apache Kylin vulnerable to remote code execution
2023-07-06 19:24:01
prion
prion
Input validation
2022-12-30 11:15:00
Command injection
2022-10-13 13:15:00
cvelist
cvelist
veracode
veracode
Command Injection
2023-01-09 11:40:04
Command Injection
2022-10-14 09:35:28
nvd
nvd
CVE-2022-24697
2022-10-13 13:15:09
f5
f5
K13249530 : Apache Kylin vulnerability CVE-2022-24697
2022-10-24 00:00:00
cnvd
cnvd
Apache Kylin Command Injection Vulnerability
2023-01-04 00:00:00
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.046
Percentile
92.7%
Related for NVD:CVE-2022-43396