# org.apache.kylin:kylin-server-base (Maven) vulnerabilities

5 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.kylin/kylin-server-base

## Advisories (5)

### [CVE-2022-44621](https://cve.now/CVE-2022-44621): Apache Kylin: Command injection by Diagnosis Controller

- Severity: Critical 9.8
- Published: Dec 30, 2022
- Affected: from 2.0.0, fixed in 4.0.3.

### [CVE-2022-24697](https://cve.now/CVE-2022-24697): Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

- Severity: Critical 9.8
- Published: Oct 13, 2022
- Affected: fixed in 4.0.2.

### [CVE-2020-13926](https://cve.now/CVE-2020-13926): Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system…

- Severity: Unrated
- Published: Jul 14, 2020
- Affected: fixed in 3.1.0.

### [CVE-2020-13925](https://cve.now/CVE-2020-13925): Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the…

- Severity: Unrated
- Published: Jul 14, 2020
- Affected: fixed in 3.1.0.

### [CVE-2020-1937](https://cve.now/CVE-2020-1937): Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database…

- Severity: Unrated
- Published: Feb 24, 2020
- Affected: fixed in 2.6.5; from 3.0.0, fixed in 3.0.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.kylin:kylin-server-base
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.