CVE-2022-44621
Published: 30 December 2022
Summary
CVE-2022-44621 is a critical-severity Command Injection (CWE-77) vulnerability in Apache Kylin. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2022-44621 is a command injection issue (CWE-77) caused by missing parameter validation in the Diagnosis Controller. The flaw is exposed via HTTP requests and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated remote attacker can send crafted HTTP requests to inject and execute operating-system commands, resulting in full compromise of confidentiality, integrity, and availability on the affected component.
Mitigation details and any associated patches are addressed in the Apache mailing-list threads referenced at https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34. The EPSS score has remained flat at its peak value of 0.0918 since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7758
Vulnerability details
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.