CVE-2025-30067

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30067
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30067.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30067
Aliases
Published
2025-03-27T15:06:36.598Z
Modified
2026-07-15T01:49:07.730617054Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Kylin: The remote code execution via jdbc url
Details

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.

This issue affects Apache Kylin: from 4.0.0 through 5.0.1.

Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "5.0.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "5.0.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-94"
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30067.json"
}
References

Affected packages

Git / github.com/apache/kylin

Affected ranges

Type
GIT
Repo
https://github.com/apache/kylin
Events
Introduced
aa6d582c0a96fdf31e85791f86850cfc00a7644f
Fixed
6a63bd3581876566b55a104ac8dcda22e97504d9
Database specific 
{
    "cpe": "cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "5.0.2"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30067.json"