CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-56325 – Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
https://notcve.org/view.php?id=CVE-2024-56325
03 Mar 2025 — Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -... • https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39676 – Apache Pinot: Unauthorized endpoint exposed sensitive information
https://notcve.org/view.php?id=CVE-2024-39676
24 Jul 2024 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/appconfigs” to the controller, it can lead to the disclosure of sensitive information such as system information (e.g. arch, os version), environment information (e.g. maxHeapSize) and Pinot configurations (e.g. zookeeper path). This... • https://lists.apache.org/thread/hsm0b2w8qr0sqy4rj1mfnnw286tslpzc • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •