CVE-2025-30067
published 2025-03-27CVE-2025-30067: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin…
PriorityP345high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.81%
53.0th percentile
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.
If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.1.
Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | kylin | >= 4.0.0 < 5.0.2 | 5.0.2 |
| apache_software_foundation | apache_kylin | 4.0.0 – 5.0.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Kylin Code Injection via JDBC Configuration Alteration
osv·2025-03-27
CVE-2025-30067 [LOW] Apache Kylin Code Injection via JDBC Configuration Alteration
Apache Kylin Code Injection via JDBC Configuration Alteration
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.
If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.1.
Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.
GHSA
Apache Kylin Code Injection via JDBC Configuration Alteration
ghsa·2025-03-27
CVE-2025-30067 [LOW] CWE-94 Apache Kylin Code Injection via JDBC Configuration Alteration
Apache Kylin Code Injection via JDBC Configuration Alteration
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.
If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.
This issue affects Apache Kylin: from 4.0.0 through 5.0.1.
Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-27
Published