CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support

2022-09-2308:05:13

apache

www.cve.org

cve-2022-26112

pinot

query endpoint

realtime ingestion

vulnerability

unprotected environments

groovy function support

apache pinot

0.10.0

older versions

pinot release 0.11.0

disabled.

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.5%

JSON

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

CNA Affected

[
  {
    "product": "Apache Pinot",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "0.10.0",
        "status": "affected",
        "version": "Apache Pinot",
        "versionType": "custom"
      }
    ]
  }
]