PT-2025-13037 · Apache · Apache Kylin

Pho3N1X · Published 2025-03-27 · Updated 2025-04-11 · CVE-2025-30067

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4.0.0 through 5.0.1

Description The issue is related to improper control of generation of code, also known as 'Code Injection'. If an attacker gains access to Kylin's system or project admin permission, they may alter the JDBC connection configuration to execute arbitrary code from a remote location. However, if Kylin's system and project admin access is well protected, the risk is mitigated.

Recommendations For Apache Kylin versions 4.0.0 through 5.0.1, upgrade to version 5.0.2 or above to fix the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-03522

CVE-2025-30067

GHSA-29M8-WH9P-5WC4

Affected Products

Apache Kylin

References · 14

• https://lists.apache.org/thread/6j19pt8yoqfphf1lprtrzoqkvz1gwbnc · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03522 · Security Note
• https://osv.dev/vulnerability/GHSA-29m8-wh9p-5wc4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30067 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30067 · Vendor Advisory
• https://github.com/apache/kylin · Note
• https://github.com/apache/kylin/commit/21d98f3ef29f71b50dacabbf039905f9f0f71b95 · Note
• https://issues.apache.org/jira/browse/KYLIN-5994 · Note
• http://openwall.com/lists/oss-security/2025/03/27/4 · Note
• https://twitter.com/CVEnew/status/1905300601975750949 · Twitter Post
• https://t.me/cvedetector/21298 · Telegram Post
• https://kylin.apache.org/docs/integration/jdbc · Note
• https://twitter.com/oss_security/status/1905121153997300078 · Twitter Post
• https://t.me/cvenotify/118923 · Telegram Post