CVE-2022-43396

Published: Dec 30, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

Affected (1)

Products: Apache: Kylin

Apache

1 product

Kylin

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Kylin	Before 4.0.3

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (2)

https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r

Source: security@apache.org

Mailing ListPatchVendor Advisory

https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

Timeline

No history available yet.