org.apache.kylin:kylin

7 results · Clear filters · Feed

• High 7.3
  CVE-2025-61735

  Apache Kylin: Server-Side Request Forgery

  Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0…

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin org.apache.kylin:kylin-core-common Maven
  Oct 2, 2025
• High 7.5
  CVE-2025-61733

  Apache Kylin: Authentication bypass

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin org.apache.kylin:kylin-core-common Maven
  Oct 2, 2025
• High 7.5
  CVE-2025-61734 EPSS 29%

  Apache Kylin: improper restriction of file read

  Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgra…

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin org.apache.kylin:kylin-core-common Maven
  Oct 2, 2025
• High 7.2
  CVE-2025-30067

  Apache Kylin: The remote code execution via jdbc url

  Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You a…

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin Maven
  Mar 27, 2025
• High 8.8
  CVE-2022-43396 EPSS 55%

  Apache Kylin: Command injection by Useless configuration

  In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin Maven
  Dec 30, 2022
• High 7.5
  CVE-2021-45458

  Hardcoded credentials

  Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlacehol…

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin Maven
  Jan 6, 2022
• High 7.5
  CVE-2021-45457

  Overly broad CORS configuration

  In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior version…

  Apache Software Foundation Apache Kylin org.apache.kylin:kylin Maven
  Jan 6, 2022