CVE-2022-26112: falha crítica em Apache Pinot
Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.6%
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache PinotCVEs relacionadas — Apache Pinot
No mesmo produto, das mais perigosas para as menos.
CVE-2024-56325CRITICALApache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredEPSS 80.2%CVE-2022-23974—Pinot segment push endpoint has a vulnerability in unprotected environmentsEPSS 2.1%CVE-2024-39676HIGHApache Pinot: Unauthorized endpoint exposed sensitive informationEPSS 0.8%CVE-2026-73322MEDIUMApache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()EPSS 0.3%