Apache Kylin vulnerabilities

Apache Kylin exposes sensitive information (system-level configuration info) to an unauthorized actor. This issue affects Apache Kylin from 4 through 5.0.4.

A vulnerability in Apache Kylin involving missing authentication for in-house broadcast and polymorphic deserialization. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.

Improper Authentication vulnerability in Apache Kylin. An unauthenticated user may access system cleanup actions. The issue affects versions from 4 through 5.0.4.

Authentication bypass within in-house network in Apache Kylin. The issue affects versions from 4.0.4 through 5.0.4.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') and Missing Authentication for Critical Function vulnerability in Apache Kylin. Certain backend cache API misses required authentication and can cause execution of injected SQL. This issue affects Apache Kylin from 5 through 5.0.4 and impacts most the Kylin services directly exposed to the public network.

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin from 4 through 5.0.4.

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses enough authorization and path-confinement. This issue affects Apache Kylin from 4 through 5.0.4 and impacts most the Kylin services directly exposed to the public network.

An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.

An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

In Apache Kylin from 4.0.0 through 5.0.4, an attacker with project admin permission may use a cache API to cause computed-column resource exhaustion. This is an allocation of resources without limits or throttling.

In Apache Kylin from 4.0.0 through 5.0.4, the default startup profile misses security settings. Any deployment with the security setting profile turned on is not impacted.

A vulnerability in Apache Kylin involving exposure of sensitive information to an unauthorized actor during job manipulation. It affects versions 4.0.0 through 5.0.4 and has minor impact unless job services are exposed to the public network.

A potential JDBC source configuration validation vulnerability in Apache Kylin. It affects versions 4.0.0 through 5.0.4 and has minor impact unless Kylin backend services are open to the public network.

An SQL Injection vulnerability in Apache Kylin due to improper neutralization of special elements used in SQL commands. It affects versions 4.0.0 through 5.0.4 and has moderate impact in the default query-only mode.

A vulnerability in Apache Kylin involving missing authorization on JDBC source configuration updates. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.

A Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. It affects versions 4.0.0 through 5.0.4 and impacts mainly the Kylin job service directly exposed to the public network.

A path-confinement bypass vulnerability in Apache Kylin during metadata backup deletion. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.

Exposure of the SQL Black List to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of Job Discard to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of Sensitive Information to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. The issue affects versions from 4.0.4 through 5.0.4.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. A special parameter in a JDBC URL can lead to code injection. Impact is most severe for Kylin services directly exposed to the public network, which is not common; in-house Kylin deployments are mostly not impacted. This issue affects Apache Kylin from 4 through 5.0.4.

An improper authorization vulnerability in Apache Kylin allows an attacker to access unauthorized jobs in other projects during job information retrieval.

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.