GitHub Advisoryadvisory · Maven

GHSA-29m8-wh9p-5wc4 Apache Kylin Code Injection via JDBC Configuration Alteration

LOW Published 2025-03-27 Modified 2025-03-27 Official page ↗
Aliases
CVE-2025-30067
Ecosystem
Maven
Packages
org.apache.kylin:kylin
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weaknesses
CWE-94
Reviewed
2025-03-27

Affected packages

• Maven org.apache.kylin:kylin: >= 4.0.0, < 5.0.2 → fixed in 5.0.2

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-30067 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References