Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
{ "nvd_published_at": "2022-01-06T13:15:00Z", "github_reviewed_at": "2022-01-07T23:21:51Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-470" ] }