Vulnerabilidades do Apache Software Foundation Kylin
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apache Software Foundation Kylin: 7 registro(s), com versões afetadas e correções.cpe:2.3:a:apache:kylin
CVE-2026-62393
Média · 4.3
CWE-280 14/07/2026
Apache Kylin: Improper authorization in job information retrieval
Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin. Improper authorization in job information retrieval, where an attacker may get access to unauthorized jobs in other projects.
This issue affects Apache Kylin: from 4 through 5.0.3.
Users are recommended to upgrade to version 5.0.4, which fixes the issue.
CVE-2026-62392
Crítica · 9.8
CWE-78 14/07/2026
Apache Kylin: OS Command Injection via Async Query API
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line.
This issue affects Apache Kylin: from 4 through 5.0.3.
Users are recommended to upgrade to version 5.0.4, which fixes the issue.
CVE-2026-62390
Crítica · 9.8
CWE-89 14/07/2026
Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL.
This issue affects Apache Kylin: from 4 through 5.0.3.
Users are recommended to upgrade to version 5.0.4, which fixes the issue.
CVE-2025-61735
Alta · 7.3
CWE-918 02/10/2025
Apache Kylin: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
CVE-2025-61734
Alta · 7.5
CWE-552 02/10/2025
Apache Kylin: improper restriction of file read
Files or Directories Accessible to External Parties vulnerability in Apache Kylin.
You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
CVE-2025-61733
Alta · 7.5
CWE-288 02/10/2025
Apache Kylin: Authentication bypass
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4.0.0 through 5.0.2.
Users are recommended to upgrade to version 5.0.3, which fixes the issue.
CVE-2020-1956
Alta · 8.8
KEV Alta · 66 Exploit público CWE-78 22/05/2020
Apache Kylin OS Command Injection Vulnerability
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.