Command Injection

org.apache.kylin:kylin-core-common is vulnerable to command injection. A remote attacker is able to pass an illegal project name due to a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService resulting in arbitrary command injection...

Apache Kylin OS Command Injection Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache kylin is vulnerable to operating system command injection, which stems from the fact tha...

Command injection

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...