CVE-2021-45456
Command injection
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
- Record
CVE-2021-45456- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
Command injection
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
- Record
CVE-2021-45456- Updated
- 2026-11-02
EUVDEUVD-2022-0621 No score
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
- Record
EUVD-2022-0621- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hw3m-8h25-8frw No score
Command Injection in Apache Kylin
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
- Record
GHSA-hw3m-8h25-8frw- Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
- Record
CVE-2021-45456- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-hw3m-8h25-8frw No score
Command Injection in Apache Kylin
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
- Record
GHSA-hw3m-8h25-8frw- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.kylin:kylinMaven |
before 4.0.1 | 4.0.1 |
org.apache.kylin:kylinMaven |
before 4.0.1, plus listed versions 0.7.1-incubating0.7.2-incubating1.0-incubating1.1-incubating1.1.1-incubating Show 40 moreShow less1.21.3.01.5.01.5.11.5.21.5.2.11.5.31.5.41.5.4.11.6.02.0.02.1.02.2.02.3.02.3.12.3.22.4.02.4.12.5.02.5.12.5.22.6.02.6.12.6.22.6.32.6.42.6.52.6.63.0.03.0.0-alpha3.0.0-alpha23.0.13.0.23.1.03.1.13.1.23.1.34.0.04.0.0-alpha4.0.0-beta |
4.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45456 is a critical vulnerability (CVSS 9.8) in Apache Kylin, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 88.9%, the 99th percentile. Fixed in org.apache.kylin:kylin 4.0.1.
References
lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf
openwall.com/lists/oss-security/2022/01/06/1
nvd.nist.gov/vuln/detail/CVE-2021-45456
github.com/apache/kylin/pull/1781