Skip to content
Fencer Intel
critical 9.8

CVE-2021-45456 in the critical feed json

Command injection

published 4y ago modified 4mo ago also GHSA-hw3m-8h25-8frw , EUVD-2022-0621

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
88.9%
EPSS 88.9% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known

Summary

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Patch / fix

  • maven org.apache.kylin:kylin 4.0.1

Is CVE-2021-45456 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

88.89% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.apache.kylin:kylin
<4.0.1
4.0.1

Affected products

  • Apache Software Foundation Apache Kylin

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.