Server-side Request Forgery (SSRF)

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can access internal resources, exfiltrate sensitive information, or perform unauthorized actions by sending crafted...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: GHSA-F6M8-QM7J-FH65...

Files or Directories Accessible to External Parties

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties due to improper restriction of file read. An attacker can obtain sensitive information by sending crafted requests...

Authentication Bypass Using an Alternate Path or Channel

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the /api/user/updateuser endpoint. An attacker can gain unauthorized access by exploiting this endpoint t...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: GHSA-P86W-W5RH-M3HX...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: SNYK:JAVA-ORGAPACHEKYLIN-13181860...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61735 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61735 Source advisory: MEND:CVE-2025-61735...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0-alpha, <=5.0.2), org.apache.ranger:ranger-kylin-plugin (>=2.5.0, <=2.9.0) +1 more potentially affected by CVE-2025-61734 via org.apache.kylin:kylin-core-common (>=4.0.4, <=5.0.2)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0-alpha, =2.5.0, =2.5.0, =2.9.0 Source cves: CVE-2025-61734 Source advisory: MEND:CVE-2025-61734...

Arbitrary Code Injection

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Arbitrary Code Injection via the alteration of the JDBC connection configuration. An attacker can execute arbitrary code by modifying the JDBC settings if they gain...

Server-side Request Forgery (SSRF)

Overview org.apache.kylin:kylin-core-common is a package part of Apache Kylin. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the /kylin/api/xxx/diag endpoint. An attacker can forge requests to internal services by invoking this specific API endpoint ...

org.apache.kylin:kylin-cache (>=2.6.0, <=4.0.0-alpha), org.apache.kylin:kylin-core-cube (>=2.0.0, <=4.0.0-alpha) +22 more potentially affected by CVE-2023-29055 via org.apache.kylin:kylin-core-common (>=2.0.0, <=4.0.0-alpha)

org.apache.kylin:kylin-core-common MAVEN version =2.0.0, =2.6.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.3.2, =2.0.0, =2.6.0, =2.3.2, =2.3.2, =2.0.0, =2.0.0, =2.6.0, =2.0.0, =3.0.2 - org.apache.kylin:kylin-spark-common 4.0.0-alpha and more Source cves: CVE-2023-29055 Source advisory: GHSA-3VVC-V8C2-43...

org.apache.kylin:kylin-core-cube (1.5.0), org.apache.kylin:kylin-core-dictionary (1.5.0) +3 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (1.5.0)

org.apache.kylin:kylin-core-common MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-core-cube 1.5.0 - org.apache.kylin:kylin-core-dictionary 1.5.0 -...

org.apache.kylin:kylin-core-cube (2.2.0), org.apache.kylin:kylin-core-dictionary (2.2.0) +7 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (2.2.0)

org.apache.kylin:kylin-core-common MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-core-cube 2.2.0 - org.apache.kylin:kylin-core-dictionary 2.2.0 -...

org.apache.kylin:kylin-core-cube (2.5.1), org.apache.kylin:kylin-core-dictionary (2.5.1) +10 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (2.5.1)

org.apache.kylin:kylin-core-common MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-core-cube 2.5.1 - org.apache.kylin:kylin-core-dictionary 2.5.1 -...

org.apache.kylin:kylin-cache (2.6.1), org.apache.kylin:kylin-core-cube (2.6.1) +13 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (2.6.1)

org.apache.kylin:kylin-core-common MAVEN version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-cache 2.6.1 - org.apache.kylin:kylin-core-cube 2.6.1 -...

org.apache.kylin:kylin-cache (2.6.5), org.apache.kylin:kylin-core-cube (2.6.5) +13 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (2.6.5)

org.apache.kylin:kylin-core-common MAVEN version 2.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-cache 2.6.5 - org.apache.kylin:kylin-core-cube 2.6.5 -...

org.apache.kylin:kylin-cache (2.6.6), org.apache.kylin:kylin-core-cube (2.6.6) +13 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (2.6.6)

org.apache.kylin:kylin-core-common MAVEN version 2.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-cache 2.6.6 - org.apache.kylin:kylin-core-cube 2.6.6 -...

org.apache.kylin:kylin-cache (3.0.0), org.apache.kylin:kylin-core-cube (3.0.0) +14 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (3.0.0)

org.apache.kylin:kylin-core-common MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-cache 3.0.0 - org.apache.kylin:kylin-core-cube 3.0.0 -...

org.apache.kylin:kylin-core-cube (1.5.4.1), org.apache.kylin:kylin-core-job (1.5.4.1) +2 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (1.5.4.1)

org.apache.kylin:kylin-core-common MAVEN version 1.5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-core-cube 1.5.4.1 - org.apache.kylin:kylin-core-job 1.5.4.1 -...

org.apache.kylin:kylin-core-cube (1.6.0), org.apache.kylin:kylin-core-job (1.6.0) +2 more potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-core-common (1.6.0)

org.apache.kylin:kylin-core-common MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-core-common and may be impacted: - org.apache.kylin:kylin-core-cube 1.6.0 - org.apache.kylin:kylin-core-job 1.6.0 -...