CVE-2021-45456

Katalog CVE

CVSS 9.8 · Critical EPSS 88,9%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada apache kylin. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Rincian

Terbit di NVD

6 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

88,9% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/01/06/1 mailing list · advisory pihak ketiga