Command Injection

org.apache.kylin:kylin-core-common is vulnerable to command injection. A remote attacker is able to pass an illegal project name due to a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService resulting in arbitrary command injection...

Apache Kylin OS Command Injection Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache kylin is vulnerable to operating system command injection, which stems from the fact tha...

Command injection

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

CVE-2021-45456: Improper Neutralization of Special Elements used in a Command

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

PT-2022-1875

Name of the Vulnerable Software and Affected Versions Apache Kylin version 4.0.0 Description The issue is related to a command injection vulnerability due to a mismatch between the checked and used project name in the DiagnosisService. This may allow an attacker to execute arbitrary commands by...