CVE-2021-45456 in the critical feed json
Command injection
published 2022-01-06 4 y ago modified 2026-06-17 4 mo ago also GHSA-hw3m-8h25-8frw , EUVD-2022-0621
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 88.9%
- EPSS 88.9% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 0
- none known
Summary
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Patch / fix
- maven org.apache.kylin:kylin 4.0.1
- github.com/apache/kylin@f4daf14 commit
- github.com/apache/kylin#1781 pull request
Exploit prediction
88.89% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.kylin:kylin | <4.0.1 |
4.0.1 |
Affected products
- Apache Software Foundation Apache Kylin
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/apache/kylin/pull/1781
web
-
github.com
/apache/kylin/commit/f4daf14dde99b934c92ce2c832509f24342bc845
web
-
lists.apache.org
/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf
web, mailing-list, vendor-advisory
-
openwall.com
/lists/oss-security/2022/01/06/1
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-45456
advisory
-
github.com
/apache/kylin
package
Sources
- CVE List CVE-2021-45456
- GitHub Advisory GHSA-hw3m-8h25-8frw
- NVD CVE-2021-45456
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.