Not rated
CVE-2022-23974 In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot…
Description
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Pinot 0.9 | earliest → 0.9.3 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Pinot
The 5 CVEs of Apache Pinot →
CVE-2026-73322
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot
Not rated
CVE-2024-56325
Authentication Bypass Issue
If the path does not contain / and contain., authentication is not required
Not rated
CVE-2024-39676
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot
Not rated
CVE-2022-26112
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in…
9.8
Critical