GitHub Advisoryadvisory · Maven

GHSA-2hpg-vwqj-6h6w Authentication bypass in Apache Kylin

MEDIUM Published 2022-02-10 Modified 2021-04-22 Official page ↗
Aliases
CVE-2020-13937
Ecosystem
Maven
Packages
org.apache.kylin:kylin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-922
Reviewed
2021-04-22

Affected packages

• Maven org.apache.kylin:kylin: < 3.1.1 → fixed in 3.1.1 • Maven org.apache.kylin:kylin: >= 4.0.0-alpha, < 4.0.0-beta → fixed in 4.0.0-beta

Description

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.

Related

Alias · CVE (1)

  • CVE-2020-13937 Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6,… vulnerability

Weakness · CWE (1)

  • CWE-922 Insecure Storage of Sensitive Information weakness

References