Apache Kylin 操作系统命令注入漏洞

Apache Kylin is the United States Apache Apache Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Kylin suffers from an operating system command...

CVE-2022-24697

CVE-2022-24697 affects Apache Kylin’s cube designer function and enables command injection/RCE by manipulating the configuration overwrite menu. The root cause described across Red Hat advisories is improper input filtering; an attacker can influence command execution by controlling the kylin.eng...

CVE-2022-24697

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...

CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...

CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...

CVE-2022-24697: Improper Neutralization of Special Elements used in an OS Command

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...

CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...

PT-2022-16810 · Kylin · Kylin

Name of the Vulnerable Software and Affected Versions: Kylin versions 2.6.5 and earlier Kylin versions 3.1.2 and earlier Kylin versions 4.0.1 and earlier Description: The issue is related to a command injection vulnerability in Kylin's cube designer function. This occurs when overwriting system...

The vulnerability of the StreamingCoordinatorController.java component of the Kylin data processing platform allows attackers to perform SSRF attacks.

The vulnerability of the StreamingCoordinatorController.java component /kylin/api/streamingcoordinator/ in the Kylin data processing platform is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks using a speciall...

Apache Kylin OS Command Injection Vulnerability

Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution...

The vulnerability of the Kylin data processing platform, related to the lack of measures for cleaning incoming data, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Kylin data processing platform is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

Authentication bypass in Apache Kylin

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

GHSA-2HPG-VWQJ-6H6W Authentication bypass in Apache Kylin

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

The vulnerability of the Class.forName(...) method in the Kylin data processing platform allows attackers to compromise the confidentiality, integrity, and accessibility of information.

The vulnerability of the Class.forName... method in the Kylin data processing platform is related to the use of externally controlled input parameters for class selection. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the JDBC driver of the Kylin data processing platform allows a hacker to execute arbitrary code.

The vulnerability of the JDBC driver of the Kylin data processing platform is related to the disclosure of information in the error data area. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Apache Kylin Input Validation Error Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface on top of Hadoop/Spark and multi-dimensional analysis OLAP and other functions. Apache kylin has an input validation error vulnerability, which stems from...

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

GHSA-MGPF-HHGF-CXG4 In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

Use of Hard-coded Credentials in Apache Kylin

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their passwor...

GHSA-9FJ5-JG6F-QG5R Use of Hard-coded Credentials in Apache Kylin

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their passwor...