Lucene search
ApacheCVELIST:CVE-2022-23974HistoryApr 05, 2022 - 7:55 p.m.
CVE-2022-23974 Pinot segment push endpoint has a vulnerability in unprotected environments
2022-04-0519:55:08
CWE-674
apache
www.cve.org
0.001 Low
EPSS
Percentile
23.5%
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
CNA Affected
[
{
"product": "Apache Pinot",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.9.3",
"status": "affected",
"version": "Apache Pinot",
"versionType": "custom"
}
]
}
]Related
osv
osv
Logic error in Apache Pinot
2022-04-06 00:01:28
CVE-2022-23974
2022-04-05 20:15:08
nvd
nvd
CVE-2022-23974
2022-04-05 20:15:08
github
github
Logic error in Apache Pinot
2022-04-06 00:01:28
cve
cve
CVE-2022-23974
2022-04-05 20:15:08
prion
prion
Design/Logic Flaw
2022-04-05 20:15:00
cnvd
cnvd
Apache Pinot Denial of Service Vulnerability
2022-04-07 00:00:00