CVE-2023-29055 — Insufficiently Protected Credentials in Apache Kylin

CWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 71.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache KylinApache Software Foundation Apache Kylin
Timeline
PublishedJan 29

Description

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials. To avoid this threat, users are recommended to * Always turn on HTTPS so that network payload is …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/kylin2.0.0 — 4.0.4
▶CVEListV5apache_software_foundation/apache_kylin2.0.0 — 4.0.3

🔴Vulnerability Details

3
OSV
Apache Kylin has Insufficiently Protected Credentials↗2024-01-29
▶
CVEList
Apache Kylin: Insufficiently protected credentials in config file↗2024-01-29
▶
GHSA
Apache Kylin has Insufficiently Protected Credentials↗2024-01-29
▶
CVE-2023-29055 — Insufficiently Protected Credentials | cvebase