Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.kylin:kylin-server-base

5 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 critical
Registry
Maven Central

Advisories 5

  • CVE-2022-44621Critical 9.8

    Apache Kylin: Command injection by Diagnosis Controller

    Affected: from 2.0.0, fixed in 4.0.3.

  • CVE-2022-24697Critical 9.8

    Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

    Affected: fixed in 4.0.2.

  • Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system…

    Affected: fixed in 3.1.0.

  • Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the…

    Affected: fixed in 3.1.0.

  • Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database…

    Affected: fixed in 2.6.5; from 3.0.0, fixed in 3.0.1.