{"id":"CVE-2024-48944","aliases":["EUVD-2025-8498","GHSA-3v67-545x-ffc3"],"status":"published","title":"Apache Kylin: SSRF vulnerability in the diagnosis api","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api\n\nendpoint open for service.\n\n\nThis issue affects Apache Kylin: from 5.0.0 \nthrough \n\n5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00643,"percentile":0.51134,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2025-03-27T15:05:57Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"Maven","package":"org.apache.kylin:kylin-common-server","fixed_in":["5.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.kylin:kylin-common-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.kylin:kylin-common-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}],"versions":["5.0.0"]}],"products":[{"vendor":"apache","product":"kylin"},{"vendor":"apache software foundation","product":"apache kylin"}],"references":[{"url":"https://lists.apache.org/thread/1xxxtdfh9hzqsqgb1pd9grb8hvqdyc9x","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/27/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48944","tags":["advisory"]},{"url":"https://github.com/apache/kylin/commit/4e6a5acd799ae7543c7161e72ef1019c74d5b4ad","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/KYLIN-5644","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3v67-545x-ffc3"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48944.json","tags":["advisory"]},{"url":"https://github.com/apache/kylin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-48944","title":"Apache Kylin: SSRF vulnerability in the diagnosis api","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api\n\nendpoint open for service.\n\n\nThis issue affects Apache Kylin: from 5.0.0 \nthrough \n\n5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","status":"published","published":"2025-03-27T15:05:57.302Z","modified":"2025-05-08T10:26:40.785Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2025-8498","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api\n\nendpoint open for service.\n\n\nThis issue affects Apache Kylin: from 5.0.0 \nthrough \n\n5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","status":"published","published":"2025-03-27T15:05:57Z","modified":"2025-05-08T10:26:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:52.039629Z"}],"ghsa":[{"id":"GHSA-3v67-545x-ffc3","title":"Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api endpoint open for service.\n\nThis issue affects Apache Kylin: from 5.0.0 through 5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","status":"published","published":"2025-03-27T15:31:10Z","modified":"2025-03-27T18:16:41Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2024-48944","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api\n\nendpoint open for service.\n\n\nThis issue affects Apache Kylin: from 5.0.0 \nthrough \n\n5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","status":"published","published":"2025-03-27T15:15:53.573Z","modified":"2026-06-17T07:59:05.867Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-48944","title":"Apache Kylin: SSRF vulnerability in the diagnosis api","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api\n\nendpoint open for service.\n\n\nThis issue affects Apache Kylin: from 5.0.0 \nthrough \n\n5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","status":"published","published":"2025-03-27T15:05:57.302Z","modified":"2026-10-28T02:30:43.528931496Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"GHSA-3v67-545x-ffc3","title":"Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint","description":"Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke \"/kylin/api/xxx/diag\" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the \"/kylin/api/xxx/diag\" api endpoint open for service.\n\nThis issue affects Apache Kylin: from 5.0.0 through 5.0.1.\n\nUsers are recommended to upgrade to version 5.0.2, which fixes the issue.","status":"published","published":"2025-03-27T15:31:10Z","modified":"2025-03-27T18:28:45.788931Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}