kylinGHSA-wrx7-qgmj-mf2q
Server-Side Request Forgery in Apache Kylin
MediumCVE-2021-27738 · Published Jan 8, 2022 · updated Dec 4, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.kylin:kylin Maven | < 3.1.3 | 3.1.3 |
Details and references
All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- CVE-2021-27738
More kylin advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 82022 | Command Injection in Apache Kylin CVE-2021-45456Mediumfixed in 4.0.1 | Medium | 4.0.1 |
| Jan 82022 | Kylin can receive user input and load any class through Class.forName(...). CVE-2021-31522Mediumfixed in 3.1.3, 4.0.1 | Medium | 3.1.3, 4.0.1 |
| Jan 82022 | SQL Injection in Apache Kylin CVE-2021-36774Medium6.5fixed in 3.1.3 | Medium6.5 | 3.1.3 |
| Jan 82022 | Use of Hard-coded Credentials in Apache Kylin CVE-2021-45458High7.5fixed in 3.1.3, 4.0.1 | High7.5 | 3.1.3, 4.0.1 |
| Jan 82022 | In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. CVE-2021-45457High7.5fixed in 3.1.3, 4.0.1 | High7.5 | 3.1.3, 4.0.1 |
| Feb 102022 | Authentication bypass in Apache Kylin CVE-2020-13937Medium5.3fixed in 3.1.1, 4.0.0-beta | Medium5.3 | 3.1.1, 4.0.0-beta |