Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2022-24697
Good to know:
Date: October 13, 2022
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
Language: Java
Severity Score
Severity Score
Top Fix
Upgrade Version
Upgrade to version org.apache.kylin:parquet-assembly:4.0.2,org.apache.kylin:kylin-server:4.0.2,org.apache.kylin:kylin-server-base:4.0.2,org.apache.kylin:kylin-core-common:4.0.2,org.apache.kylin:kylin-tool:4.0.2,org.apache.kylin:kylin-tool-assembly:4.0.2
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | HIGH |
| Availability (A): | HIGH |