CVE-2024-48944

CWE-918 — Server-Side Request Forgery (SSRF)4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 65.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache KylinApache Software Foundation Apache Kylin
Timeline
PublishedMar 27

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/xxx/diag" api endpoint open for service. This issue affects Apache Kylin: from 5.0.0 through 5.0.1. Users are recommended to upgrade to version 5…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/kylin5.0.0 — 5.0.2
▶CVEListV5apache_software_foundation/apache_kylin5.0.0 — 5.0.1

🔴Vulnerability Details

3
OSV
Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint↗2025-03-27
▶
GHSA
Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint↗2025-03-27
▶
CVEList
Apache Kylin: SSRF vulnerability in the diagnosis api↗2025-03-27
▶