Authentication Bypass

Apache Pinot is vulnerable to Authentication Bypass. The vulnerability is due to improper request path validation due to the application's failure to enforce authentication when the request path contains a semicolon ; and lacks a forward slash /, allowing unauthorized user creation...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to improper handling of specific path conditions in the authentication process, where the path does not contain / and contains .. An attacker can gain unauthorized access and...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to improper handling of specific path conditions in the authentication process, where the path does not contain / and contains .. An attacker can gain unauthorized access and...

GHSA-6JWP-4WVJ-6597 Apache Pinot Vulnerable to Authentication Bypass

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to improper handling of specific path conditions in the authentication process, where the path does not contain / and contains .. An attacker can gain unauthorized access and...

Apache Pinot Vulnerable to Authentication Bypass

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.0.5), com.navercorp.pinpoint:pinpoint-collector-starter (>=2.5.0, <=3.0.5) +57 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-common (>=0.8.0, <=1.2.0)

org.apache.pinot:pinot-common MAVEN version =0.8.0, =3.0.0, =2.5.0, =3.0.0, =3.0.0, =3.0.0, =2.5.0, =3.0.1, =3.0.1, =2.5.1, =2.5.1, =3.0.0, =2.5.1, =2.5.1, =2.5.0, =2024.4.0, =2025.1.1 and more Source cves: CVE-2024-56325 Source advisory: GHSA-6JWP-4WVJ-6597...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.0.5), com.navercorp.pinpoint:pinpoint-collector-starter (>=3.0.0, <=3.0.5) +44 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-common (>=1.0.0, <=1.2.0)

org.apache.pinot:pinot-common MAVEN version =1.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1, =3.0.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2024.4.0, =2025.1.1 and more Source cves: CVE-2024-56325 Source advisory: SNYK:JAVA-ORGAPACHEPINOT-9637839...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.0.5), com.navercorp.pinpoint:pinpoint-collector-starter (>=2.5.0, <=3.0.5) +57 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-common (>=0.8.0, <=1.2.0)

org.apache.pinot:pinot-common MAVEN version =0.8.0, =3.0.0, =2.5.0, =3.0.0, =3.0.0, =3.0.0, =2.5.0, =3.0.1, =3.0.1, =2.5.1, =2.5.1, =3.0.0, =2.5.1, =2.5.1, =2.5.0, =2024.4.0, =2025.1.1 and more Source cves: CVE-2024-56325 Source advisory: OSV:GHSA-6JWP-4WVJ-6597...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +7 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-controller (>=0.8.0, <=1.2.0)

org.apache.pinot:pinot-controller MAVEN version =0.8.0, =0.8.0, =0.11.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: OSV:GHSA-6JWP-4WVJ-6597...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +7 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-controller (>=0.8.0, <=1.2.0)

org.apache.pinot:pinot-controller MAVEN version =0.8.0, =0.8.0, =0.11.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: GHSA-6JWP-4WVJ-6597...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +4 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-broker (>=0.8.0, <=0.10.0)

org.apache.pinot:pinot-broker MAVEN version =0.8.0, =0.8.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: OSV:GHSA-6JWP-4WVJ-6597...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +4 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-broker (>=0.8.0, <=0.10.0)

org.apache.pinot:pinot-broker MAVEN version =0.8.0, =0.8.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: GHSA-6JWP-4WVJ-6597...

CVE-2024-56325

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.1.0, <=0.10.0) +7 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-controller (>=0.1.0, <=1.2.0)

org.apache.pinot:pinot-controller MAVEN version =0.1.0, =0.1.0, =0.11.0, =0.9.0, =0.1.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: MEND:CVE-2024-56325...

org.apache.pinot:pinot-compatibility-verifier (0.10.0), org.apache.pinot:pinot-distribution (>=0.8.0, <=0.10.0) +4 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-broker (>=0.8.0, <=0.10.0)

org.apache.pinot:pinot-broker MAVEN version =0.8.0, =0.8.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.10.0 Source cves: CVE-2024-56325 Source advisory: MEND:CVE-2024-56325...

Apache Pinot security vulnerabilities

Apache Pinot is a real-time distributed OLAP data store from the Apache USA Foundation. It is designed to provide ultra-low latency analytics. A security vulnerability exists in Apache Pinot versions prior to 1.3 that stems from an authentication bypass issue that allows unauthorized users to add...