CVE-2021-27738

    Dashboard / Vulnerabilities / CVE-2021-27738

    CVE-2021-27738

    Published: 6 Jan 2022Last Modified: 8 Jul 2026

    Summary:

    Details: All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

    References: http://www.openwall.com/lists/oss-security/2022/01/06/6, https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c75242a9b55fd57a3a58d92a2dfa9f21cfe4eebc
    Fixed -f2639f670f82b39884a7c4d264d3b26dc938ae46

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-27738 | CVE-DB