CVE-2021-45457 Overly broad CORS configuration
Attackers can exploit overly broad CORS settings to send credentialed cross-origin requests, potentially bypassing security controls and accessing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45457?
CVE-2021-45457 is a high-severity vulnerability in Apache Kylin, published on 6 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Weakness: CWE-863
Which versions are affected by CVE-2021-45457?
4 open source packages ship an affected version, including org.apache.kylin:kylin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.kylin:kylin Maven | All versions | 3.1.3 |
org.apache.kylin:kylin Maven | All versions | 3.1.3 |
org.apache.kylin:kylin Maven | From 4.0.0 | 4.0.1 |
org.apache.kylin:kylin Maven | From 4.0.0 | 4.0.1 |
Products include Apache Kylin.
How do I fix CVE-2021-45457?
Upgrade org.apache.kylin:kylin to a fixed version for your release line: 3.1.3 or 4.0.1.
Is CVE-2021-45457 being exploited?
There is no known exploitation of CVE-2021-45457 in the wild and no public exploit code.
Other vulnerabilities in Apache Kylin
- CVE-2020-1956 Apache Kylin OS Command Injection
- CVE-2026-62390 Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
- CVE-2022-44621 Apache Kylin: Command injection by Diagnosis Controller
- CVE-2022-24697 Apache Kylin vulnerable to remote code execution
- CVE-2021-31522 Apache Kylin unsafe class loading
Sources
Also known as GHSA-mgpf-hhgf-cxg4.