CVE-2022-24697

Deeper analysis

Apache Kylin contains a command injection vulnerability in its cube designer function, specifically when system parameters are overwritten through the configuration overwrites menu. By closing the single quotation marks around the value of the "--conf=" parameter, an attacker can inject arbitrary operating system commands. The flaw affects Kylin 2 versions up to and including 2.6.5, Kylin 3 versions up to and including 3.1.2, and Kylin 4 versions up to and including 4.0.1, and carries a CVSS score of 9.8 under CWE-78.

Unauthenticated remote attackers can exploit the issue over the network without user interaction to achieve full remote code execution on the affected Kylin instance, potentially compromising confidentiality, integrity, and availability of the system.

Public advisories published through the Apache mailing lists and oss-security detail the affected releases and recommend upgrading to patched versions once available. The EPSS score rose materially from lower values to a peak of 0.4033 on 2025-12-11 before receding to the current 0.1359, indicating increased exploitation interest after disclosure.