CVE-2021-36774: SQL Injection in Apache Kylin
Summary
CVE-2021-36774: SQL Injection in Apache Kylin. Affects org.apache.kylin:kylin versions < 3.1.3. Fixed in 3.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Kylin is an open-source distributed analytics engine designed to provide SQL interface and multi-dimensional analysis (OLAP) on big data for data warehousing. It allows users to read data from other database systems using JDBC. The vulnerability in Apache Kylin arises from the MySQL JDBC driver's support for certain properties, which, if not properly mitigated, can enable an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes.
Vulnerability Detail
The SQL Injection vulnerability in Apache Kylin (CVE-2021-36774) affects versions 2.6.6 and prior of Apache Kylin 2, as well as versions 3.1.2 and prior of Apache Kylin 3. By exploiting this vulnerability, an attacker can execute arbitrary code within Kylin server processes by leveraging a malicious MySQL server. This can lead to unauthorized access, data manipulation, or even complete compromise of the Kylin server. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.1.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is strongly advised to follow the recommended fix by upgrading to the patched versions of Apache Kylin.
Conclusion
The SQL Injection vulnerability in Apache Kylin poses a moderate risk to the security and integrity of affected systems. It is crucial to promptly upgrade to the patched versions of Apache Kylin to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
Apache Kylin is an open-source distributed analytics engine designed for data warehousing, providing SQL interface and multi-dimensional analysis (OLAP) on big data.
The SQL Injection vulnerability in Apache Kylin can allow an attacker to execute arbitrary code within Kylin server processes, potentially leading to unauthorized access, data manipulation, or complete compromise of the Kylin server.
The vulnerability affects Apache Kylin 2 versions 2.6.6 and prior, as well as Apache Kylin 3 versions 3.1.2 and prior.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix the vulnerability, it is recommended to upgrade to Apache Kylin version 3.1.3 or later for Apache Kylin 2, and version 3.1.3 or later for Apache Kylin 3.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
