CVE-2022-23974: falha em Apache Pinot
Pinot segment push endpoint has a vulnerability in unprotected environments
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.1%
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Produtos afetados
Apache Software Foundation · Apache PinotCVEs relacionadas — Apache Pinot
No mesmo produto, das mais perigosas para as menos.
CVE-2024-56325CRITICALApache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredEPSS 80.2%CVE-2022-26112CRITICALPinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportEPSS 1.6%CVE-2024-39676HIGHApache Pinot: Unauthorized endpoint exposed sensitive informationEPSS 0.8%CVE-2026-73322MEDIUMApache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()EPSS 0.2%