Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Kylin
APPApache4.0.0
Powiązane podatności
Session Fixation w Apache Kylin — przejęcie sesji użytkownika
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the...
Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 ...
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands an...