Advisory Details

March 3rd, 2025

Apache Pinot Improper Neutralization of Special Elements Authentication Bypass Vulnerability

CVE ID	CVE-2024-56325
CVSS SCORE	9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	Apache
AFFECTED PRODUCTS	Pinot
VULNERABILITY DETAILS	This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.
ADDITIONAL DETAILS	Fixed in version 1.3.0
DISCLOSURE TIMELINE	2024-07-16 - Vulnerability reported to vendor 2025-03-03 - Coordinated public release of advisory 2025-03-03 - Advisory Updated
CREDIT	Sunflower@Knownsec 404 Team

BACK TO ADVISORIES