-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.pinot:pinot-controller | maven | >= 0.1, < 1.0.0 | 1.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability centers on unauthenticated access to the /appconfigs endpoint. In Java web applications, endpoints are typically mapped to controller methods. The documentation indicates RBAC was required to secure this endpoint post-1.0.0, implying the handler method lacked authorization checks. The standard Pinot controller API structure suggests configuration endpoints would be in a ControllerResource class, with the method name following get convention. While exact implementation details aren't available, the endpoint-specific nature of the vulnerability strongly points to its handler function being the vulnerable component.