CVE-2022-24697
CriticalApache Kylin vulnerable to remote code execution
Published Jul 6, 2023 · Updated Aug 12, 2026 · Also known as GHSA-ppxx-m926-g569
Key Facts
Patch immediately- CVE-2022-24697 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Kylin (Apache), org.apache.kylin:kylin-core-common (maven), org.apache.kylin:kylin-server-base (maven) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 85% probability of exploitation in the next 30 days.
- Fixed versions are available, including Kylin 2.6.6, org.apache.kylin:kylin-core-common 4.0.2, org.apache.kylin:kylin-server-base 4.0.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
85%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-24697 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
Affected Products
5 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| KylinApache | >= Apache Kylin 2 | 2.6.6 |
| org.apache.kylin:kylin-core-commonmaven | See advisory | 4.0.2 |
| org.apache.kylin:kylin-server-basemaven | See advisory | 4.0.2 |
| org.apache.kylin:kylin-spark-projectmaven | See advisory | 4.0.2 |
Patched Releases
Kylin
2.6.6
org.apache.kylin:kylin-core-common
4.0.2
org.apache.kylin:kylin-server-base
4.0.2
org.apache.kylin:kylin-spark-project
4.0.2
Timeline
Publicly disclosed
Jul 6, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24697.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2022-24697
- patchhttps://lists.apache.org/thread/07mnn9c7o314wrhrwjr10w9j5s82voj4
- patch[oss-security] 20221230 CVE-2022-43396: Apache Kylin: Command injection by Useless configuration
FAQ
Common Questions.
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu.
Affected: Kylin (Apache) versions >= Apache Kylin 2; org.apache.kylin:kylin-core-common (maven); org.apache.kylin:kylin-server-base (maven), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Kylin 2.6.6, org.apache.kylin:kylin-core-common 4.0.2, org.apache.kylin:kylin-server-base 4.0.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-24697 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo