CVE-2022-26112

CWE-94 — Code Injection4 documents4 sources
Severity
9.8CRITICAL
EPSS
1.9%
top 16.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache PinotApache Software Foundation Apache Pinot
Timeline
PublishedSep 23
Latest updateSep 25

Description

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/pinot< 0.11.0
▶Mavenorg.apache.pinot:pinot< 0.11.0
▶CVEListV5apache_software_foundation/apache_pinotApache Pinot — 0.10.0

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

3
OSV
Apache Pinot has Groovy Function support enabled by default↗2022-09-25
▶
GHSA
Apache Pinot has Groovy Function support enabled by default↗2022-09-25
▶
CVEList
Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support↗2022-09-23
▶
CVE-2022-26112 (CRITICAL CVSS 9.8) | In 0.10.0 or older versions of Apac | cvebase.io