Overview 7 matches · 6 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
Protected by Waratek
6
85.7%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
14.3%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
6
85.7%
partly blocked
0
0.0%
not blocked
1
14.3%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
14.3%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
2
28.6%
No public exploit
4
57.1%
split by
peak 2 / quarter
Q3 202
Protected by Waratek2
Critical2
blocked by ARMR today2
Exploited1
No public exploit1
Q4 200
Q1 210
Q2 210
Q3 210
Q4 210
Q1 222
Protected by Waratek2
Critical2
blocked by ARMR today2
Forecast only1
No public exploit1
Q2 220
Q3 220
Q4 222
Protected by Waratek2
Critical2
blocked by ARMR today2
Forecast only1
No public exploit1
Q1 230
Q2 230
Q3 230
Q4 230
Q1 240
Q2 240
Q3 240
Q4 241
No exploit published1
Critical1
not blocked1
No public exploit1
Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-23590 | Critical | 2024-11-04 | No exploit published | No public exploit | Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue. |
| CVE-2022-44621 | Critical | 2022-12-30 | Protected by Waratek | No public exploit | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
| CVE-2022-24697 | Critical | 2022-10-13 | Protected by Waratek | Forecast only | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier. |
| CVE-2021-45456 | Critical | 2022-01-06 | Protected by Waratek | Forecast only | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0. |
| CVE-2021-31522 | Critical | 2022-01-06 | Protected by Waratek | No public exploit | Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions. |
| CVE-2020-13926 | Critical | 2020-07-14 | Protected by Waratek | No public exploit | Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0. |
| CVE-2020-13925 | Critical | 2020-07-14 | Protected by Waratek | Exploited | Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0. |