GHSA-wrx7-qgmj-mf2q

    Dashboard / Vulnerabilities / GHSA-wrx7-qgmj-mf2q

    GHSA-wrx7-qgmj-mf2q

    Published: 8 Jan 2022Last Modified: 4 Dec 2024

    Summary: Server-Side Request Forgery in Apache Kylin

    Details: All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-27738, https://github.com/apache/kylin/pull/1646, https://github.com/apache/kylin, https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70, http://www.openwall.com/lists/oss-security/2022/01/06/6

    Affected packages

    Package

    Name: org.apache.kylin:kylin

    Purl: pkg:maven/org.apache.kylin/kylin

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.1.3

    Affected versions

    0.7.1-incubating
    0.7.2-incubating

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wrx7-qgmj-mf2q | CVE-DB