CVE-2022-43396

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

Score

CVSS 3.1 8.8 High

Status

Modified - security@apache.org

Published

2022-12-30

Last modified

2025-04-11

Weaknesses

CWE-184

Affected products

• Kylin (Apache)
• Apache Kylin (Apache Software Foundation)

References

• https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r