CVE-2024-48944

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/xxx/diag" api

endpoint open for service.

This issue affects Apache Kylin: from 5.0.0 through

5.0.1.

Users are recommended to upgrade to version 5.0.2, which fixes the issue.

Published: Mar 27, 2025
Updated: Aug 11, 2025
CVE: CVE-2024-48944
GHSA: GHSA-3v67-545x-ffc3
Severity: Low
Exploit:

No technical information available.

CWEs:

CWE-918

Affected Software
References

Software	From	Fixed in
org.apache.kylin / kylin-common-server	5.0.0	5.0.2
apache / kylin	5.0.0	5.0.2

http://www.openwall.com/lists/oss-security/2025/03/27/5
https://github.com/apache/kylin/commit/4e6a5acd799ae7543c7161e72ef1019c74d5b4ad
https://issues.apache.org/jira/browse/KYLIN-5644
https://lists.apache.org/thread/1xxxtdfh9hzqsqgb1pd9grb8hvqdyc9x

Vulnerability Database

CVE-2024-48944

Deep Security Visibility Without the Complexity