CVEsApache Software FoundationCVE-2022-23974Published Apr 5, 2022, 19:55 · Updated Aug 3, 2024, 03:59 UTC
7.5
HighCVSS 3.1 · from NVD
CVE-2022-23974
Pinot segment push endpoint has a vulnerability in unprotected environments
Apache Pinot · CWE-674 · CWE-674AffectedApache Pinot
FixNo fix listed yet.
PublishedApr 5, 2022, 19:55 · apache
Scored7.5 · NVD
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.
Description
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
From apache
Affected and fixed versions
ProductAffectedFixed inApache PinotApache Pinot – 0.9.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known