CVE-2022-43396 — Apache Kylin: Command injection by Useless configuration
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kyli…
Published: 2022-12-30 · CVSS: 8.8 · CVSS 3.1
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7