CVE-2023-29055 json
Apache Kylin: Insufficiently protected credentials in config file
published 2024-01-29 2 y ago modified 2026-06-17 4 mo ago also GHSA-3vvc-v8c2-43r7 , EUVD-2024-0235
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials.
To avoid this threat, users are recommended to
* Always turn on HTTPS so that network payload is encrypted.
* Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers.
* Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.
Patch / fix
- maven org.apache.kylin:kylin-core-common 4.0.4
- apache kylin 4.0.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.kylin:kylin-core-common | >=2.0.0, <4.0.4 |
4.0.4 |
Affected products
- Apache Software Foundation Apache Kylin
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/apache/kylin/commit/b60d5ae694dffc2281bfe0ef464eada0b3a9b774
web
-
lists.apache.org
/thread/o1bvyv9wnfkx7dxpfjlor20nykgsoh6r
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2024/01/29/1
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2023-29055
advisory
-
github.com
/apache/kylin
package
Sources
- CVE List CVE-2023-29055
- GitHub Advisory GHSA-3vvc-v8c2-43r7
- NVD CVE-2023-29055
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.