Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.kylin/kylin-core-common@4.0.4
Typemaven
Namespaceorg.apache.kylin
Namekylin-core-common
Version4.0.4
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.0.3
Latest_non_vulnerable_version5.0.3
Affected_by_vulnerabilities
0
url VCID-5h7z-8j2q-k3hk
vulnerability_id VCID-5h7z-8j2q-k3hk
summary 
Apache Kylin Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties vulnerability in Apache Kylin.
You are fine as long as the Kylin's system and project admin access is well protected.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-61734
reference_id
reference_type
scores
0
value 0.00082
scoring_system epss
scoring_elements 0.24196
published_at 2026-06-06T12:55:00Z
1
value 0.00082
scoring_system epss
scoring_elements 0.24214
published_at 2026-06-05T12:55:00Z
2
value 0.00089
scoring_system epss
scoring_elements 0.25409
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-61734
1
reference_url https://github.com/apache/kylin
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin
2
reference_url https://github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662
3
reference_url https://github.com/apache/kylin/pull/2332
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/pull/2332
4
reference_url https://issues.apache.org/jira/browse/KYLIN-6082
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/KYLIN-6082
5
reference_url https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-02T17:26:13Z/
url https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2
6
reference_url http://www.openwall.com/lists/oss-security/2025/09/30/8
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2025/09/30/8
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-61734
reference_id CVE-2025-61734
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-61734
8
reference_url https://github.com/advisories/GHSA-p86w-w5rh-m3hx
reference_id GHSA-p86w-w5rh-m3hx
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-p86w-w5rh-m3hx
fixed_packages
0
url pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
purl pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
aliases CVE-2025-61734, GHSA-p86w-w5rh-m3hx
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5h7z-8j2q-k3hk
1
url VCID-74vu-bu5d-zqgq
vulnerability_id VCID-74vu-bu5d-zqgq
summary 
Apache Kylin Authentication Bypass Vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-61733
reference_id
reference_type
scores
0
value 0.00097
scoring_system epss
scoring_elements 0.26725
published_at 2026-06-06T12:55:00Z
1
value 0.00097
scoring_system epss
scoring_elements 0.26735
published_at 2026-06-05T12:55:00Z
2
value 0.00107
scoring_system epss
scoring_elements 0.28513
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-61733
1
reference_url https://github.com/apache/kylin
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin
2
reference_url https://github.com/apache/kylin/commit/8b2cb8c71bd9885d70dad4f1a9822e38d9949b8c
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/commit/8b2cb8c71bd9885d70dad4f1a9822e38d9949b8c
3
reference_url https://github.com/apache/kylin/pull/2336
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/pull/2336
4
reference_url https://issues.apache.org/jira/browse/KYLIN-6081
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/KYLIN-6081
5
reference_url https://lists.apache.org/thread/8wmcffly6gp50nmfw8j4w3hlmv843yo0
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-10-03T03:55:31Z/
url https://lists.apache.org/thread/8wmcffly6gp50nmfw8j4w3hlmv843yo0
6
reference_url http://www.openwall.com/lists/oss-security/2025/09/30/7
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2025/09/30/7
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-61733
reference_id CVE-2025-61733
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-61733
8
reference_url https://github.com/advisories/GHSA-mr9j-4j48-xcm2
reference_id GHSA-mr9j-4j48-xcm2
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mr9j-4j48-xcm2
fixed_packages
0
url pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
purl pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
aliases CVE-2025-61733, GHSA-mr9j-4j48-xcm2
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-74vu-bu5d-zqgq
2
url VCID-dzkm-q626-pug7
vulnerability_id VCID-dzkm-q626-pug7
summary 
Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-61735
reference_id
reference_type
scores
0
value 0.001
scoring_system epss
scoring_elements 0.27239
published_at 2026-06-06T12:55:00Z
1
value 0.001
scoring_system epss
scoring_elements 0.27291
published_at 2026-06-05T12:55:00Z
2
value 0.00108
scoring_system epss
scoring_elements 0.28627
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-61735
1
reference_url https://github.com/apache/kylin
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin
2
reference_url https://github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/commit/22eb8fd5dfdeffa3fc57bae6d5c82a019eece662
3
reference_url https://github.com/apache/kylin/pull/2332
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/pull/2332
4
reference_url https://issues.apache.org/jira/browse/KYLIN-6082
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/KYLIN-6082
5
reference_url https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-02T14:10:47Z/
url https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh
6
reference_url http://www.openwall.com/lists/oss-security/2025/09/30/9
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2025/09/30/9
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-61735
reference_id CVE-2025-61735
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-61735
8
reference_url https://github.com/advisories/GHSA-f6m8-qm7j-fh65
reference_id GHSA-f6m8-qm7j-fh65
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-f6m8-qm7j-fh65
fixed_packages
0
url pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
purl pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin-core-common@5.0.3
aliases CVE-2025-61735, GHSA-f6m8-qm7j-fh65
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dzkm-q626-pug7
Fixing_vulnerabilities
0
url VCID-2mp1-7zce-dkh8
vulnerability_id VCID-2mp1-7zce-dkh8
summary 
Apache Kylin has Insufficiently Protected Credentials
In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials.

To avoid this threat, users are recommended to

*  Always turn on HTTPS so that network payload is encrypted.

*  Avoid putting credentials in kylin.properties, or at least not in plain text.
*  Use network firewalls to protect the serverside such that it is not accessible to external attackers.

*  Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-29055
reference_id
reference_type
scores
0
value 0.00103
scoring_system epss
scoring_elements 0.27757
published_at 2026-06-07T12:55:00Z
1
value 0.00103
scoring_system epss
scoring_elements 0.27846
published_at 2026-06-05T12:55:00Z
2
value 0.00103
scoring_system epss
scoring_elements 0.27795
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-29055
1
reference_url https://github.com/apache/kylin
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin
2
reference_url https://github.com/apache/kylin/commit/b60d5ae694dffc2281bfe0ef464eada0b3a9b774
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kylin/commit/b60d5ae694dffc2281bfe0ef464eada0b3a9b774
3
reference_url https://lists.apache.org/thread/o1bvyv9wnfkx7dxpfjlor20nykgsoh6r
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-02T17:14:27Z/
url https://lists.apache.org/thread/o1bvyv9wnfkx7dxpfjlor20nykgsoh6r
4
reference_url http://www.openwall.com/lists/oss-security/2024/01/29/1
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-02T17:14:27Z/
url http://www.openwall.com/lists/oss-security/2024/01/29/1
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-29055
reference_id CVE-2023-29055
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-29055
6
reference_url https://github.com/advisories/GHSA-3vvc-v8c2-43r7
reference_id GHSA-3vvc-v8c2-43r7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3vvc-v8c2-43r7
fixed_packages
0
url pkg:maven/org.apache.kylin/kylin-core-common@4.0.4
purl pkg:maven/org.apache.kylin/kylin-core-common@4.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5h7z-8j2q-k3hk
1
vulnerability VCID-74vu-bu5d-zqgq
2
vulnerability VCID-dzkm-q626-pug7
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin-core-common@4.0.4
aliases CVE-2023-29055, GHSA-3vvc-v8c2-43r7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2mp1-7zce-dkh8
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kylin/kylin-core-common@4.0.4