{"id":"CVE-2022-24697","published":"2022-10-13T00:00:00Z","modified":"2025-05-16T13:42:57Z","title":"Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system…","vendor":"Apache Software Foundation","product":"Apache Kylin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Kylin","versions":[">= Apache Kylin 2, < 2.6.6",">= Apache Kylin 3, <= 3.1.2",">= Apache Kylin 4, <= 4.0.1"]}],"description":{"text":"Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Kylin's cube designer, in its configuration overwrite function, contains an OS command injection flaw in the handling of system parameter overrides. An attacker can break out of the quoted \"--conf=\" parameter value to inject arbitrary operating system commands, and the attack needs only network access with no authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:22Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.84777,"percentile":0.99708,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://lists.apache.org/thread/07mnn9c7o314wrhrwjr10w9j5s82voj4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/12/30/1","tags":["mailing-list"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.kylin:kylin-core-common","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"from":["GHSA-ppxx-m926-g569"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.kylin:kylin-spark-project","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"from":["GHSA-ppxx-m926-g569"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.kylin:kylin-server-base","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"from":["GHSA-ppxx-m926-g569"],"provenance":"source"}],"advisories":[{"id":"GHSA-ppxx-m926-g569","url":"https://github.com/advisories/GHSA-ppxx-m926-g569","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.kylin:kylin-core-common","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-ppxx-m926-g569","url":"https://github.com/advisories/GHSA-ppxx-m926-g569","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.kylin:kylin-spark-project","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-ppxx-m926-g569","url":"https://github.com/advisories/GHSA-ppxx-m926-g569","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.kylin:kylin-server-base","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2116","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2116","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-10-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-24697","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9971"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-1937","published":"2020-02-24","fixed":"3.0.1","kev":false},{"cve":"CVE-2020-13925","published":"2020-07-14","fixed":"3.1.0","kev":false},{"cve":"CVE-2020-13926","published":"2020-07-14","fixed":"3.1.0","kev":false},{"cve":"CVE-2022-24697","published":"2022-10-13","fixed":"4.0.2","kev":false},{"cve":"CVE-2022-44621","published":"2022-12-30","fixed":"4.0.3","kev":false,"link":{"from":"CVE-2022-24697","to":"CVE-2022-44621","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.kylin:kylin-server-base","fromFixed":"4.0.2","toFixed":"4.0.3","daysApart":78}]}}],"package":"Maven:org.apache.kylin:kylin-server-base"}}