Non notée
CVE-2022-24697 Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the…
Description
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Kylin 4.0 | premières → 4.0.1 | Pas de correctif indiqué |
| Apache Kylin 3.1 | premières → 3.1.2 | Pas de correctif indiqué |
| Apache Kylin 2.6 | premières → < 2.6.6 | 2.6.6 |
Références
- lists.apache.org lists.apache.org
- [oss-security] 20221230 CVE-2022-43396: Apache Kylin: Command injection by Useless configuration www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Kylin
Les 40 CVE de Apache Kylin →
CVE-2026-108837
Apache Kylin: Potential computed-column resource exhaustion
Non notée
CVE-2026-108833
Apache Kylin: default startup profile miss security settings
Non notée
CVE-2026-108823
Apache Kylin: Potential unauthenticated job metadata replacement
Non notée
CVE-2026-108780
Potential JDBC source configuration validation vulnerability in Apache Kylin
Non notée