CVE-2021-36774

Description

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.805

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-45457,CVE-2021-45458,CVE-2021-27738,CVE-2021-36774,CVE-2021-31522 are fixed in Apache - kylin 3.1.3	Windows
Vulnerabilities CVE-2021-45457,CVE-2021-45458,CVE-2021-27738,CVE-2021-36774,CVE-2021-31522 are fixed in Apache - kylin for Linux 3.1.3	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234