AI analysis
Apache Kylin versions 4 through 5.0.4 contain a code-injection flaw (CWE-94) in which a special parameter in a JDBC URL bypasses whitelist verification and can cause code injection. An attacker who can supply that JDBC URL parameter may execute injected code in the Kylin process. Impact is greatest for Kylin services exposed directly to the public network, which the vendor says is uncommon; typical in-house deployments are mostly not affected. No CVSS score, public proof-of-concept, or CISA KEV listing is known. Users should upgrade to 5.0.5.
What to do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services directly to the public internet, and restrict who can supply JDBC connection URLs.
Affected
| Apache Kylin | 4 through 5.0.4 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.