Files or Directories Accessible to External Parties

Overview org.apache.kylin:kylin-server is an analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis OLAP on Hadoop supporting extremely large datasets. Affected versions of this package are vulnerable to Files or Directories Accessible to External Partie...

Server-side Request Forgery (SSRF)

Overview org.apache.kylin:kylin-server is an analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis OLAP on Hadoop supporting extremely large datasets. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can...

CVE-2024-48944: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1 The attacker has got admin access to a kylin...

Privilege Escalation

kylin-server-base is vulnerable to privilege escalation. The vulnerability exists in the setParam function in QueryService.java, allowing an attacker to load any class through the Class.forName function...

SQL Injection

kylin-server-base is vulnerable to SQL injection. SQL statements are concatenated and executed in the CLI or beeline when building new segments, allowing an attacker to inject and execute arbitrary SQL statements if system configurations are overwritten via rest APIs...

OS Command Injection

kylin-server-base is vulnerable to OS Command Injection. The vulnerability exists as the values of srcCfgUri, dstCfgUri, and projectName, in CubeService.java is not properly handled...

SQL Injection

kylin-server-base is vulnerable to SQL injection. User input to some RESTful APIs is not validated and sanitized before being concatenated to SQL queries. This allows an attacker to inject and execute arbitrary SQL statements in the database...