← CVE Intelligence

CVE-2022-43396

Apache Kylin: Command injection by Useless configuration PUBLISHED

Description (CNA)

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache Kylinaffected Apache Kylin 4 through 4.0.2

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.