WaratekVRT Sign in

Org.apache.kylin CVEs with no public exploit

3 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Vendor org.apache.kylin✕
Overview 3 matches · 0 exploited · 0 CISA KEV · 0 public PoC
3matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 66.7% High 1 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 3 100.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 3 High: 1Critical: 2 blocked by ARMR today: 3 Forecast only: 3
Jan 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1 Feb 220 Mar 220 Apr 220 May 220 Jun 220 Jul 220 Aug 220 Sep 220 Oct 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1 Nov 220 Dec 221 Protected by Waratek1 High1 blocked by ARMR today1 Forecast only1
Jan 22Feb 22Mar 22Apr 22May 22Jun 22Jul 22Aug 22Sep 22Oct 22Nov 22Dec 22
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-43396 High 2022-12-30 Protected by Waratek Forecast only In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
CVE-2022-24697 Critical 2022-10-13 Protected by Waratek Forecast only Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
CVE-2021-45456 Critical 2022-01-06 Protected by Waratek Forecast only Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.