CVE-2021-31522: Apache Kylin unsafe class loading
Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-31522.
What is the severity level of CVE-2021-31522?
CVE-2021-31522 has a severity level of critical (9.8).
Which versions of Apache Kylin are affected by CVE-2021-31522?
CVE-2021-31522 affects Apache Kylin 2 version 2.6.6 and prior versions, Apache Kylin 3 version 3.1.2 and prior versions, and Apache Kylin 4 version 4.0.0 and prior versions.
What is the impact of CVE-2021-31522?
CVE-2021-31522 allows an attacker to provide user input and load any class, potentially leading to remote code execution.
Are there any references available for CVE-2021-31522?
Yes, you can find more information about CVE-2021-31522 at the following references: [Reference 1](http://www.openwall.com/lists/oss-security/2022/01/06/4) and [Reference 2](https://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw).