CVE-2025-61735

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh	Issue Tracking Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/09/30/9

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en Apache Kylin. Este problema afecta a Apache Kylin: desde la 4.0.0 hasta la 5.0.2. No hay problema siempre y cuando el acceso de administrador del sistema y del proyecto de Kylin esté bien protegido. Se recomienda a los usuarios actualizar a la versión 5.0.3, que corrige el problema.

Information

Published : 2025-10-02 10:15

Updated : 2026-10-12 15:10

NVD link : CVE-2025-61735

Mitre link : CVE-2025-61735

CVE.ORG link : CVE-2025-61735

JSON object : View

Products Affected

apache

kylin

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-61735", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61735", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-02T14:10:47.999022Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Kylin", "versions": [{"status": "affected", "version": "4.0.0", "versionType": "semver", "lessThanOrEqual": "5.0.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-02T10:15:40.250", "references": [{"url": "https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/30/9", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2.\u00a0You are fine as long as the Kylin's system and project admin access is well protected.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en Apache Kylin.\n\nEste problema afecta a Apache Kylin: desde la 4.0.0 hasta la 5.0.2. No hay problema siempre y cuando el acceso de administrador del sistema y del proyecto de Kylin est\u00e9 bien protegido.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 5.0.3, que corrige el problema."}], "lastModified": "2026-10-12T15:10:00.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0732C89B-68F0-406A-977F-C75F554B17DD", "versionEndExcluding": "5.0.3", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}