Detections
Analytics

SCA: security update for org.apache.kylin:kylin-core-common (GHSA-3vvc-v8c2-43r7)

high Tenable Self-Hosted Container Security Plugin ID 409711

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content
 of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP
 (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get
 access to the content of kylin.properties and potentially the containing credentials. To avoid this
 threat, users are recommended to * Always turn on HTTPS so that network payload is encrypted. * Avoid
 putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect
 the serverside such that it is not accessible to external attackers. * Upgrade to version Apache Kylin
 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.
 (CVE-2023-29055)

See Also

https://github.com/advisories/GHSA-3vvc-v8c2-43r7

Plugin Details

Severity: High

ID: 409711

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-29055

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/29/2024

Vulnerability Publication Date: 1/29/2024

Reference Information

CVE: CVE-2023-29055

cwe: CWE-522