GHSA-f5q9-j9r2-34gq
Apache Kylin vulnerable to Command injection by Useless configuration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.kylin:kylin | >= 2.0.0, < 4.0.3 | 4.0.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the `kylin.engine.spark-cmd` parameter of `conf`.
References
External links from the advisory. They lead to third-party sites.