GitHub Advisoryadvisory · Maven

GHSA-hw3m-8h25-8frw Command Injection in Apache Kylin

MEDIUM Published 2022-01-08 Modified 2022-01-07 Official page ↗
Aliases
CVE-2021-45456
Ecosystem
Maven
Packages
org.apache.kylin:kylin
Severity
Moderate
Weaknesses
CWE-77
Reviewed
2022-01-07

Affected packages

• Maven org.apache.kylin:kylin: < 4.0.1 → fixed in 4.0.1

Description

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Related

Alias · CVE (1)

  • CVE-2021-45456 Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References