TI-2024-32635 Aliases CVE-2024-48944 GHSA-3v67-545x-ffc3

Apache Kylin: SSRF vulnerability in the diagnosis api

LOW 30CWE-918Published 2025-03-27 · Updated 2025-05-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/xxx/diag" api endpoint open for service. This issue affects Apache Kylin: from 5.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00643 51st percentileScored 2026-11-07

Fix Fixed org.apache.kylin:kylin-common-server (Maven): 5.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Kylin	5.0.0 – 5.0.1	—	No fix listed	CNA
—	org.apache.kylin:kylin-common-server (Maven)	5.0.0 to before 5.0.2	5.0.2	Patch available	GHSA-3v67-545x-ffc3

Apache Kylin VendorApache Affected 5.0.0 – 5.0.1 Fixed in — No fix listed CNA
org.apache.kylin:kylin-common-server (Maven) Vendor— Affected 5.0.0 to before 5.0.2 Fixed in 5.0.2 Patch available GHSA-3v67-545x-ffc3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:kylin::::::::	5.0.0 to before 5.0.2	Vulnerable	Apache

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.0.2 Vulnerable ·Apache

Remediation

Fix · GHSA-3v67-545x-ffc3 org.apache.kylin:kylin-common-server (Maven) Fixed in 5.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-48944
2026-10-03 Alias added: GHSA-3v67-545x-ffc3
2026-10-21 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 3

TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
TI-2021-20543 Command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences