CVE-2021-27738

All request mappings in StreamingCoordinatorController.java handling /kylin/api/streamingcoordinator/ REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification...

CVE-2021-27738

CVE-2021-27738 concerns Apache Kylin prior to 3.1.2 where all request mappings in StreamingCoordinatorController.java under /kylin/api/streaming_coordinator/* lacked input validation and security checks. This enables unauthenticated users to issue arbitrary requests (e.g., assigning/unassigning s...