CVE-2022-23974CWE-674

Pinot segment push endpoint has a vulnerability in unprotected environments

published April 5, 2022

CVSS
—
EPSS
2%
Percentile
81.3
In the wild
Unconfirmed
What it is

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02076 · 81.3th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2022-04-05T19:55Z
EPSS history
Timeline
  • 05 APR 19:55Z
    Pinot segment push endpoint has a vulnerability in unprotected environments
    cvelistv5