What is CVE-2022-23974?

CVE-2022-23974 is a high-severity vulnerability in Apache Pinot, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2022-04-05.

How severe is CVE-2022-23974?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2022-23974 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Pinot

CVE-2022-23974

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exp…

EPSS: 0.020 (78.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Apache Pinot
Apache Software Foundation Pinot — versions Apache Pinot

Weakness classification (CWE)

CWE-674 — Uncontrolled Recursion

Public proof-of-concept exploits

karimhabush/cyberowl

References

security@apache.org (Mailing List, x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-23974?: CVE-2022-23974 is a high-severity vulnerability in Apache Pinot, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2022-04-05.
How severe is CVE-2022-23974?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2022-23974 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.