Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2021-45456

UNKNOWN
Published 2022-01-06T12:35:21
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2021-45456. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Apache Software Foundation

Apache Kylin

Affected Versions:

Apache Kylin 4 4.0.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Command Injection in Apache Kylin

GHSA-hw3m-8h25-8frw

Advisory Details

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Affected Packages

Maven org.apache.kylin:kylin
ECOSYSTEM: ≥0 <4.0.1

CVSS Scoring

CVSS Score

5.0

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-45456
WEB https://github.com/apache/kylin/pull/1781
WEB https://github.com/apache/kylin/commit/f4daf14dde99b934c92ce2c832509f24342bc845
PACKAGE https://github.com/apache/kylin
WEB https://lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf
WEB http://www.openwall.com/lists/oss-security/2022/01/06/1

Advisory provided by GitHub Security Advisory Database. Published: January 8, 2022, Modified: January 7, 2022

References

https://lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf
http://www.openwall.com/lists/oss-security/2022/01/06/1
Published: 2022-01-06T12:35:21
Last Modified: 2024-08-04T04:39:21.067Z
Copied to clipboard!