CVE-2021-31522: 
Java vulnerability analysis and mitigation

Apache Kylin was found to be vulnerable to unsafe class loading, identified as CVE-2021-31522. The vulnerability allows Kylin to receive user input and load any class through Class.forName(...). This security issue affects multiple versions including Apache Kylin 2 version 2.6.6 and prior versions, Apache Kylin 3 version 3.1.2 and prior versions, and Apache Kylin 4 version 4.0.0 and prior versions. The vulnerability was disclosed in January 2022 (Apache Mail, OSS Security).

The vulnerability stems from Kylin's ability to receive user input and load arbitrary classes through the Class.forName(...) method, which could potentially lead to unsafe class loading. The severity of this vulnerability is considered moderate (OSS Security).

The unsafe class loading vulnerability could potentially allow attackers to load arbitrary classes, which might lead to security implications in the Apache Kylin environment (CVE Mitre).

Users of Kylin 2.x & Kylin 3.x are advised to upgrade to version 3.1.3 or apply the patch available at https://github.com/apache/kylin/pull/1695. For Kylin 4.x users, the recommendation is to upgrade to version 4.0.1 or apply the patch available at https://github.com/apache/kylin/pull/1763 (OSS Security).