Vulnerabilities > CVE-2021-31522 - Unsafe Reflection vulnerability in Apache Kylin

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

apache

CWE-470

NVD

Published: 2022-01-06

Updated: 2022-01-12

Summary

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Kylin 2.0.0 Apache Kylin 2.1.0 Apache Kylin 2.2.0 Apache Kylin 2.3.0 Apache Kylin 2.3.1 Apache Kylin 2.3.2 Apache Kylin 2.4.0 Apache Kylin 2.4.1 Apache Kylin 2.5.0 Apache Kylin 2.5.1 Apache Kylin 2.5.2 Apache Kylin 2.6.0 Apache Kylin 2.6.1 Apache Kylin 2.6.2 Apache Kylin 2.6.3 Apache Kylin 2.6.4 Apache Kylin 2.6.5 Apache Kylin 2.6.6 Apache Kylin 3.0.0 Apache Kylin 3.0.1 Apache Kylin 3.0.2 Apache Kylin 3.1.0 Apache Kylin 3.1.1 Apache Kylin 3.1.2 Apache Kylin 4.0.0	30

Common Weakness Enumeration (CWE)

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References