CVE-2022-44621: Apache Kylin vulnerable to Command injection by Diagnosis Controller

December 30, 2022 (updated January 9, 2023)

Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.

References

github.com/advisories/GHSA-w9rv-xmf7-x3gh
github.com/apache/kylin/pull/2011
lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34
nvd.nist.gov/vuln/detail/CVE-2022-44621

Detect and mitigate CVE-2022-44621 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →