Vulnerabilities > CVE-2021-31522 - Unsafe Reflection vulnerability in Apache Kylin

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

apache

CWE-470

critical

NVD

Published: 2022-01-06

Updated: 2022-01-12

Summary

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Kylin 4.0.0 Apache Kylin 3.0.0 Apache Kylin 3.0.1 Apache Kylin 3.0.2 Apache Kylin 3.1.0 Apache Kylin 3.1.1 Apache Kylin 3.1.2 Apache Kylin 2.0.0 Apache Kylin 2.1.0 Apache Kylin 2.2.0 Apache Kylin 2.3.0 Apache Kylin 2.3.1 Apache Kylin 2.3.2 Apache Kylin 2.4.0 Apache Kylin 2.4.1 Apache Kylin 2.5.0 Apache Kylin 2.5.1 Apache Kylin 2.5.2 Apache Kylin 2.6.0 Apache Kylin 2.6.1 Apache Kylin 2.6.2 Apache Kylin 2.6.3 Apache Kylin 2.6.4 Apache Kylin 2.6.5	29

Common Weakness Enumeration (CWE)

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References