Apache Pinot vulnerabilities

CVE-2024-56325 [CRITICAL] CWE-288 CVE-2024-56325: Authentication Bypass Issue If the path does not contain / and contain., authentication is not requ Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithCom

CVE-2024-39676 [HIGH] CWE-200 CVE-2024-39676: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issu Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/appconfigs” to the controller, it can lead to the disclosure of sensit

CVE-2022-26112 [CRITICAL] CWE-94 CVE-2022-26112: In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0

CVE-2022-23974 [HIGH] CWE-674 CVE-2022-23974: In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imp In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/ba