Every CVE whose affected-product data names Apache Kylin, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (21)
CVE-2020-13925 — CVSS 9.8 (critical): Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the…
CVE-2022-24697 — CVSS 9.8 (critical): Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites…
CVE-2020-13926 — CVSS 9.8 (critical): Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system…
CVE-2021-31522 — CVSS 9.8 (critical): Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior…
CVE-2022-44621 — CVSS 9.8 (critical): Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
CVE-2021-45456 — CVSS 9.8 (critical): Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a…
CVE-2024-23590 — CVSS 9.1 (critical): Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade…
CVE-2022-43396 — CVSS 8.8 (high): In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can…
CVE-2020-1937 — CVSS 8.8 (high): Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database…
CVE-2021-45458 — CVSS 7.5 (high): Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm…
CVE-2021-27738 — CVSS 7.5 (high): All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not…
CVE-2021-45457 — CVSS 7.5 (high): In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version…
CVE-2023-29055 — CVSS 7.5 (high): In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that…
CVE-2025-61733 — CVSS 7.5 (high): Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through…
CVE-2025-61734 — CVSS 7.5 (high): Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project…
CVE-2025-61735 — CVSS 7.3 (high): Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine…
CVE-2025-30067 — CVSS 7.2 (high): Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or…
CVE-2024-48944 — CVSS 6.5 (medium): Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke…
CVE-2021-36774 — CVSS 6.5 (medium): Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if…