CVE-2022-43396

CVE-2022-43396 is a critical command injection vulnerability affecting Apache Kylin, stemming from an insufficient blacklist-based fix for a previous CVE. An authenticated attacker can bypass input filtering by manipulating the kylin.engine.spark-cmd parameter, leading to arbitrary command execution. With a CVSS score of 8.8 (High), this vulnerability allows for complete compromise of confidentiality, integrity, and availability with low attack complexity. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the potential for severe impact necessitates immediate patching.