Advisoriesby IbiskylinGHSA-29m8-wh9p-5wc4
Apache Kylin Code Injection via JDBC Configuration Alteration
Fix: upgrade to 5.0.2 or later
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.
If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.1.
Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | >= 4.0.0, < 5.0.2 | 5.0.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2025-30067
More kylin advisories
All kylin
Apache Kylin Files or Directories Accessible to External PartiesCVE-2025-61734fixed in 5.0.3Apache Kylin Authentication Bypass VulnerabilityCVE-2025-61733fixed in 5.0.3Apache Kylin Server-Side Request Forgery (SSRF) VulnerabilityCVE-2025-61735fixed in 5.0.3Apache Kylin Session Fixation vulnerabilityCVE-2024-23590fixed in 5.0.0Apache Kylin vulnerable to Command injection by Useless configurationCVE-2022-43396fixed in 4.0.3Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1