-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.kylin:kylin-core-common | maven | >= 2.0.0, < 4.0.4 | 4.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the exportAllToString() method in KylinConfig.java which was responsible for exposing configuration properties through the web interface. The commit diff shows this function previously lacked filtering for credential-related properties (those containing 'password'). The patched version adds explicit filtering at this location, confirming this was the vulnerable code path that exposed credentials when using plain HTTP.