Apache

Kylin

24 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2022-43396

  • EPSS 55%
  • Veröffentlicht 30.12.2022 11:15:10
  • Zuletzt bearbeitet 11.04.2025 15:15:39

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

9.8

CVE-2022-44621

  • EPSS 2.99%
  • Veröffentlicht 30.12.2022 11:15:10
  • Zuletzt bearbeitet 11.04.2025 15:15:40

Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.

9.8

CVE-2022-24697

  • EPSS 84.78%
  • Veröffentlicht 13.10.2022 13:15:09
  • Zuletzt bearbeitet 16.05.2025 14:15:27

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inj...

7.5

CVE-2021-45458

  • EPSS 2.08%
  • Veröffentlicht 06.01.2022 13:15:08
  • Zuletzt bearbeitet 21.11.2024 06:32:14

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class Passwor...

7.5

CVE-2021-45457

  • EPSS 2.38%
  • Veröffentlicht 06.01.2022 13:15:08
  • Zuletzt bearbeitet 21.11.2024 06:32:14

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prio...

9.8

CVE-2021-45456

  • EPSS 88.89%
  • Veröffentlicht 06.01.2022 13:15:08
  • Zuletzt bearbeitet 21.11.2024 06:32:14

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. ...

6.5

CVE-2021-36774

  • EPSS 1.95%
  • Veröffentlicht 06.01.2022 13:15:08
  • Zuletzt bearbeitet 21.11.2024 06:14:04

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL ser...

9.8

CVE-2021-31522

  • EPSS 2.9%
  • Veröffentlicht 06.01.2022 13:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:51

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

7.5

CVE-2021-27738

  • EPSS 2.56%
  • Veröffentlicht 06.01.2022 13:15:07
  • Zuletzt bearbeitet 21.11.2024 05:58:29

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/u...

5.3

CVE-2020-13937

  • EPSS 78.33%
  • Veröffentlicht 19.10.2020 21:15:12
  • Zuletzt bearbeitet 21.11.2024 05:02:11

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which expose...