CVE-2025-61735CWE-918ssrf

CVE-2025-61735

High · published October 2, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
44.3
In the wild
Unconfirmed
What it is

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00535 · 44.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-10-02T14:15Z
Affected products (1)
ProductVersionsFixed in
apache/kylin≥ 4.0.0, < 5.0.35.0.3
References (2)
https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh · [email protected]http://www.openwall.com/lists/oss-security/2025/09/30/9 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 OCT 09:47Z
    Apache Kylin: Server-Side Request Forgery
    cvelistv5