Is CVE-2021-45456 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Software Foundation Kylin

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in Diagnos…

EPSS: 0.892 (99.8th percentile) — read the EPSS interpretation.

Affected products

Apache Software Foundation Kylin — versions Apache Kylin 4 4.0.0

Public proof-of-concept exploits

ARPSyndicate/cve-scores
ARPSyndicate/cvemon
Awrrays/FrameVul
cc8700619/poc
zhanpengliu-tencent/medium-cve

References

lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf (x_refsource_MISC)
[oss-security] 20220106 CVE-2021-45456: Apache Kylin: Command injection (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2021-45456?: CVE-2021-45456 is a vulnerability in Apache Software Foundation Kylin. Published 2022-01-06.
Is CVE-2021-45456 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.