Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.pinot/pinot@0.11.0
Typemaven
Namespaceorg.apache.pinot
Namepinot
Version0.11.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.3.0
Latest_non_vulnerable_version1.3.0
Affected_by_vulnerabilities
0
url VCID-bz18-zy1s-4bbn
vulnerability_id VCID-bz18-zy1s-4bbn
summary 
Apache Pinot Vulnerable to Authentication Bypass
Authentication Bypass Issue

If the path does not contain / and contain., authentication is not required.

Expected Normal Request and Response Example
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-56325
reference_id
reference_type
scores
0
value 0.17409
scoring_system epss
scoring_elements 0.95198
published_at 2026-06-05T12:55:00Z
1
value 0.17409
scoring_system epss
scoring_elements 0.95203
published_at 2026-06-09T12:55:00Z
2
value 0.17409
scoring_system epss
scoring_elements 0.952
published_at 2026-06-08T12:55:00Z
3
value 0.17409
scoring_system epss
scoring_elements 0.95201
published_at 2026-06-07T12:55:00Z
4
value 0.17409
scoring_system epss
scoring_elements 0.95199
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-56325
1
reference_url https://github.com/apache/pinot
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/pinot
2
reference_url https://github.com/apache/pinot/commit/1b87488aeaf4836e3ef25b426ebbf1ad5a68e68f
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/pinot/commit/1b87488aeaf4836e3ef25b426ebbf1ad5a68e68f
3
reference_url https://github.com/apache/pinot/pull/14383
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/pinot/pull/14383
4
reference_url https://github.com/apache/pinot/releases/tag/release-1.3.0
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/pinot/releases/tag/release-1.3.0
5
reference_url https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-18T14:23:26Z/
url https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
6
reference_url http://www.openwall.com/lists/oss-security/2025/03/27/8
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2025/03/27/8
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-56325
reference_id CVE-2024-56325
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-56325
8
reference_url https://github.com/advisories/GHSA-6jwp-4wvj-6597
reference_id GHSA-6jwp-4wvj-6597
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6jwp-4wvj-6597
fixed_packages
0
url pkg:maven/org.apache.pinot/pinot@1.3.0
purl pkg:maven/org.apache.pinot/pinot@1.3.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pinot/pinot@1.3.0
aliases CVE-2024-56325, GHSA-6jwp-4wvj-6597
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bz18-zy1s-4bbn
Fixing_vulnerabilities
0
url VCID-h71c-m8zg-jfhx
vulnerability_id VCID-h71c-m8zg-jfhx
summary 
Apache Pinot has Groovy Function support enabled by default
Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-26112
reference_id
reference_type
scores
0
value 0.01863
scoring_system epss
scoring_elements 0.83415
published_at 2026-06-04T12:55:00Z
1
value 0.01863
scoring_system epss
scoring_elements 0.83443
published_at 2026-06-09T12:55:00Z
2
value 0.01863
scoring_system epss
scoring_elements 0.83429
published_at 2026-06-08T12:55:00Z
3
value 0.01863
scoring_system epss
scoring_elements 0.83436
published_at 2026-06-07T12:55:00Z
4
value 0.01863
scoring_system epss
scoring_elements 0.8344
published_at 2026-06-06T12:55:00Z
5
value 0.01863
scoring_system epss
scoring_elements 0.83439
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-26112
1
reference_url https://docs.pinot.apache.org/basics/releases/0.11.0
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://docs.pinot.apache.org/basics/releases/0.11.0
2
reference_url https://github.com/apache/pinot
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/pinot
3
reference_url https://github.com/apache/pinot/pull/8711
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/pinot/pull/8711
4
reference_url https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-27T14:46:24Z/
url https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-26112
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-26112
6
reference_url https://github.com/advisories/GHSA-qj9p-jvmw-82rh
reference_id GHSA-qj9p-jvmw-82rh
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qj9p-jvmw-82rh
fixed_packages
0
url pkg:maven/org.apache.pinot/pinot@0.11.0
purl pkg:maven/org.apache.pinot/pinot@0.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bz18-zy1s-4bbn
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pinot/pinot@0.11.0
aliases CVE-2022-26112, GHSA-qj9p-jvmw-82rh
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-h71c-m8zg-jfhx
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pinot/pinot@0.11.0