CVE-2022-44621— Apache Kylin: Command injection by Diagnosis Controller
Quick assessment
Affected
Apache Software Foundation Apache Kylin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Kylin是美国阿帕奇（Apache）基金会的一款开源的分布式分析型数据仓库。该产品主要提供Hadoop/Spark之上的SQL查询接口及多维分析（OLAP）等功能。 Apache Kylin 存在命令注入漏洞，攻击者利用该漏洞可以通过 HTTP Request进行命令注入攻击。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-44621
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Kylin: Command injection by Diagnosis Controller
Source: CVE Program / CVE List V5
Vulnerability Description
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Kylin 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Kylin是美国阿帕奇（Apache）基金会的一款开源的分布式分析型数据仓库。该产品主要提供Hadoop/Spark之上的SQL查询接口及多维分析（OLAP）等功能。 Apache Kylin 存在命令注入漏洞，攻击者利用该漏洞可以通过 HTTP Request进行命令注入攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Kylin | Apache Kylin 4 ~ 4.0.2 | - |
|
II. Public POCs for CVE-2022-44621
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-44621
请登录查看更多情报信息。
Mailing List Discussions for CVE-2022-44621 (1)
-
https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34 vendor-advisory
IV. Related Vulnerabilities
Same product: Apache Kylin
-
CVE-2026-62393
Apache Kylin: Improper authorization in job information retr -
CVE-2026-62392
Apache Kylin: OS Command Injection via Async Query API -
CVE-2026-62390
Apache Kylin: SQL Injection Vulnerability in Catalog Cache R -
CVE-2025-61735
Apache Kylin: Server-Side Request Forgery -
CVE-2025-61733
Apache Kylin: Authentication bypass
Same vendor: Apache Software Foundation
-
CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-s -
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end -
CVE-2026-68763
Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tra -
CVE-2026-68569
Apache Tomcat: Principal lookup can fail open in some cases -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp
V. Comments for CVE-2022-44621
No comments yet