CVE-2021-45456

Description

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

47.751

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-45457,CVE-2021-45458,CVE-2021-31522,CVE-2021-45456 are fixed in Apache - kylin 4.0.1	Windows
Vulnerabilities CVE-2021-45457,CVE-2021-45458,CVE-2021-31522,CVE-2021-45456 are fixed in Apache - kylin for Linux 4.0.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234