CVE-2021-45456: Command injection
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-45456 vulnerability?
CVE-2021-45456 is a vulnerability in Apache Kylin that allows an illegal project name to pass and potentially execute unauthorized commands.
What is the severity of CVE-2021-45456?
CVE-2021-45456 has a severity rating of 9.8 (Critical).
Which version of Apache Kylin is affected by CVE-2021-45456?
Apache Kylin version 4.0.0, 4.0.0-alpha, and 4.0.0-beta are affected by CVE-2021-45456.
How can this vulnerability be exploited?
This vulnerability can be exploited by passing an illegal project name that bypasses the legitimacy check in Apache Kylin, allowing execution of unauthorized commands.
Are there any fixes or patches available for CVE-2021-45456?
At the time of writing, there are no known fixes or patches available for CVE-2021-45456. It is recommended to keep an eye on the official Apache Kylin website or mailing list for any updates or security advisories.