CVE-2024-48944

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/xxx/diag" api endpoint open for service. This issue affects Apache Kylin: from 5.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2, which fixes the issue.

• CWE-918

• https://lists.apache.org/thread/1xxxtdfh9hzqsqgb1pd9grb8hvqdyc9xMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/03/27/5Mailing List, Third Party Advisory

Published

Mar 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-48937Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.…6.1
• CVE-2024-48938Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.…7.5
• CVE-2024-48939Insufficient validation performed on the REST API License fi…7.5
• CVE-2024-4894ITPison OMICARD EDM fails to properly filter specific URL p…5.3
• CVE-2024-48941The Syracom Secure Login (2FA) plugin for Jira, Confluence, …5.4
• CVE-2024-48942The Syracom Secure Login (2FA) plugin for Jira, Confluence, …5.9
• CVE-2024-48948The Elliptic package 6.5.7 for Node.js, in its for ECDSA imp…4.8
• CVE-2024-48949The verify function in lib/elliptic/eddsa/index.js in the El…9.1
• CVE-2024-4895The wpDataTables – WordPress Data Table, Dynamic Tables & Ta…4.7
• CVE-2024-48950An issue was discovered in Logpoint before 7.5.0. An endpoin…7.5
• CVE-2024-48951An issue was discovered in Logpoint before 7.5.0. Server-Sid…7.5
• CVE-2024-48952An issue was discovered in Logpoint before 7.5.0. SOAR uses …6.4