Read the docs
TI-2023-13505 Aliases CVE-2023-29055GHSA-3vvc-v8c2-43r7

Apache Kylin: Insufficiently protected credentials in config file

Priority MEDIUM 41CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials. To avoid this threat, users are recommended to  * Always turn on HTTPS so that network payload is encrypted. * Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers. * Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01149 67th percentileScored 2026-11-07
Fix Fixed org.apache.kylin:kylin-core-common (Maven): 4.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Kylin2.0.0 – 4.0.3—No fix listedCNA
—org.apache.kylin:kylin-core-common (Maven)2.0.0 to before 4.0.44.0.4Patch availableGHSA-3vvc-v8c2-43r7
  • Apache Kylin VendorApache Affected 2.0.0 – 4.0.3 Fixed in — No fix listed CNA
  • org.apache.kylin:kylin-core-common (Maven) Vendor— Affected 2.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-3vvc-v8c2-43r7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*2.0.0 to before 4.0.4VulnerableApache
  • cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* Versions 2.0.0 to before 4.0.4 Vulnerable ·Apache

Remediation

  • Fix · GHSA-3vvc-v8c2-43r7 org.apache.kylin:kylin-core-common (Maven) Fixed in 4.0.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29055
  2. 2026-10-03 Alias added: GHSA-3vvc-v8c2-43r7

References

Advisory 2

Other 3

  • TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
  • TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
  • TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
  • TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences