CVE-2020-13937: Authentication bypass in Apache Kylin
Summary
CVE-2020-13937: Authentication bypass in Apache Kylin. Affects org.apache.kylin:kylin across 2 version ranges.
< 3.1.1
>= 4.0.0-alpha, < 4.0.0-beta
Fixed in 3.1.1 or 4.0.0-beta, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kylin is an open-source distributed analytics engine designed to provide SQL interface and multi-dimensional analysis (OLAP) on big data for data warehousing. It allows users to query large-scale datasets in real-time. However, versions 2.0.0 to 4.0.0-beta of Apache Kylin are vulnerable to an authentication bypass issue.
Vulnerability Detail
The affected versions of Apache Kylin expose a RESTful API that allows unauthorized access to Kylin's configuration information without any authentication. This vulnerability poses a risk as it can disclose confidential information entries to anyone who accesses the API. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data and potentially compromise the security of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.13.1.1 -
>= 4.0.0-alpha, < 4.0.0-beta4.0.0-beta
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the fixed version of Apache Kylin.
Conclusion
Apache Kylin versions 2.0.0 to 4.0.0-beta are vulnerable to an authentication bypass issue that exposes Kylin's configuration information without any authentication. This can lead to unauthorized access to sensitive data. It is crucial to upgrade to the fixed version of Apache Kylin to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
Apache Kylin is an open-source distributed analytics engine designed for data warehousing and OLAP analysis.
Versions 2.0.0 to 4.0.0-beta of Apache Kylin are affected by this vulnerability.
This vulnerability allows unauthorized access to Kylin's configuration information, potentially exposing confidential data and compromising system security.
To fix this vulnerability, upgrade to a fixed version of Apache Kylin. For versions 2.0.0 to 3.1.0, upgrade to version 3.1.1. For versions 4.0.0-alpha to 4.0.0-beta, upgrade to a later version once available.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by upgrading to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
