WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Vendor org.apache.kylin✕
Overview 5 matches · 4 protected · 1 exploited · 1 CISA KEV · 2 public PoC
5matches 4protected80.0% 1exploited20.0% 1CISA KEV20.0% 2public PoC40.0%
Protected by Waratek 4 80.0% Rule in development 0 0.0% Mitigation candidate 1 20.0% No exploit published 0 0.0%
Critical 2 40.0% High 2 40.0% Medium 1 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 80.0% partly blocked 0 0.0% not blocked 1 20.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 20.0% Working exploit published 1 20.0% Proof of concept only 0 0.0% Forecast only 3 60.0% No public exploit 0 0.0%
split by peak 2 / quarter
Mitigation candidate: 1Protected by Waratek: 4 Medium: 1High: 2Critical: 2 not blocked: 1blocked by ARMR today: 4 Forecast only: 3Working exploit published: 1Exploited: 1
Q2 201 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 200 Q4 201 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q1 210 Q2 210 Q3 210 Q4 210 Q1 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1 Q2 220 Q3 220 Q4 222 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 Forecast only2
Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-43396 High 2022-12-30 Protected by Waratek Forecast only In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
CVE-2022-24697 Critical 2022-10-13 Protected by Waratek Forecast only Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
CVE-2021-45456 Critical 2022-01-06 Protected by Waratek Forecast only Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
CVE-2020-13937 Medium 2020-10-19 Mitigation candidate Working exploit published Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
CVE-2020-1956 High 2020-05-22 Protected by Waratek Exploited Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.