AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

kylinGHSA-752q-72qc-rc66

Apache Kylin Session Fixation vulnerability

kylin

CVE-2024-23590 · Published Nov 4, 2024 · updated Jul 11, 2025

High9.1
Fix: upgrade to 5.0.0 or later
GitHub advisory

Session Fixation vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 2.0.0 through 4.x.

Users are recommended to upgrade to version 5.0.0 or above, which fixes the issue.

Affected versions

PackageAffectedFixed in
org.apache.kylin:kylin
Maven
>= 2.0.0, < 5.0.05.0.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-384
Also known as
CVE-2024-23590

More kylin advisories

All kylin
High 7.5Oct 2, 2025Apache Kylin Files or Directories Accessible to External PartiesCVE-2025-61734fixed in 5.0.3High 7.5Oct 2, 2025Apache Kylin Authentication Bypass VulnerabilityCVE-2025-61733fixed in 5.0.3High 7.3Oct 2, 2025Apache Kylin Server-Side Request Forgery (SSRF) VulnerabilityCVE-2025-61735fixed in 5.0.3LowMar 27, 2025Apache Kylin Code Injection via JDBC Configuration AlterationCVE-2025-30067fixed in 5.0.2High 8.8Dec 30, 2022Apache Kylin vulnerable to Command injection by Useless configurationCVE-2022-43396fixed in 4.0.3Medium 5.3Feb 10, 2022Authentication bypass in Apache KylinCVE-2020-13937fixed in 3.1.1 +1