org.apache.ranger:ranger-kylin-plugin (>=2.5.0 <=2.8.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.5.0 <=2.8.0) potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-metadata (=4.0.4)

org.apache.kylin:kylin-core-metadata MAVEN version =4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-metadata and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2025-617...

org.apache.ranger:ranger-kylin-plugin (>=2.5.0 <=2.8.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.5.0 <=2.8.0) potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-metadata (=4.0.4)

org.apache.kylin:kylin-core-metadata MAVEN version =4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-metadata and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2025-617...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted requests to internal or protected endpoints. Note: This is only exploitabl...

org.apache.ranger:ranger-kylin-plugin (>=2.5.0 <=2.8.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.5.0 <=2.8.0) potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-metadata (=4.0.4)

org.apache.kylin:kylin-core-metadata MAVEN version =4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-metadata and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2025-617...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties due to improper restriction of file read. An attacker can obtain sensitive information by sending crafted requests to exposed resources. Note: This is only exploitable if the attacker...

org.apache.ranger:ranger-kylin-plugin (>=2.5.0 <=2.8.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.5.0 <=2.8.0) potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-metadata (=4.0.4)

org.apache.kylin:kylin-core-metadata MAVEN version =4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-metadata and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2025-617...

org.apache.kylin:kylin-cache (>=2.6.0 <=4.0.0-alpha), org.apache.kylin:kylin-core-cube (>=1.5.0 <=4.0.0-alpha) +23 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (>=1.5.0 <=4.0.0-alpha)

org.apache.kylin:kylin-core-common MAVEN version =1.5.0, =2.6.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =2.3.2, =1.5.0, =2.6.0, =2.3.2, =2.3.2, =2.0.0, =2.0.0, =2.6.0, =2.0.0, =3.0.2 - org.apache.kylin:kylin-spark-common =4.0.0-alpha and more Source cves: CVE-2022-24697 Source advisory:...