CVE-2022-23974 json
Pinot segment push endpoint has a vulnerability in unprotected environments
published 2022-04-05 4 y ago modified 2026-06-17 4 mo ago also GHSA-29f8-q7mf-7cqj , EUVD-2022-1594
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Patch / fix
Exploit prediction
2.08% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.pinot:pinot | <0.10.0 |
0.10.0 |
Affected products
- Apache Software Foundation Apache Pinot
Classification
- Weakness
-
- CWE-674 Uncontrolled Recursion
References
-
github.com
/apache/pinot/pull/7969
web
-
lists.apache.org
/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr
web, mailing-list, release-notes, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-23974
advisory
-
docs.pinot.apache.org
/basics/releases/0.10.0
web
-
github.com
/apache/pinot
package
Sources
- CVE List CVE-2022-23974
- GitHub Advisory GHSA-29f8-q7mf-7cqj
- NVD CVE-2022-23974
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.