CVE-2022-26112

{"containers": {"cna": {"affected": [{"product": "Apache Pinot", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "0.10.0", "status": "affected", "version": "Apache Pinot", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Apache Pinot would like to thank Haoruo Chen(chenhaoruo0128@gmail.com) for reporting the issue"}], "descriptions": [{"lang": "en", "value": "In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0"}], "problemTypes": [{"descriptions": [{"description": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-23T08:05:13.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h"}], "source": {"discovery": "UNKNOWN"}, "title": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2022-26112", "STATE": "PUBLIC", "TITLE": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Pinot", "version": {"version_data": [{"version_affected": "<=", "version_name": "Apache Pinot", "version_value": "0.10.0"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Apache Pinot would like to thank Haoruo Chen(chenhaoruo0128@gmail.com) for reporting the issue"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h", "refsource": "MISC", "url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:56:37.549Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-27T14:46:24.747770Z", "id": "CVE-2022-26112", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-27T14:46:56.726Z"}}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2022-26112", "datePublished": "2022-09-23T08:05:13.000Z", "dateReserved": "2022-02-25T00:00:00.000Z", "dateUpdated": "2025-05-27T14:46:56.726Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:56:37.549Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-26112", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-27T14:46:24.747770Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-27T14:46:53.749Z"}}], "cna": {"title": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "value": "Apache Pinot would like to thank Haoruo Chen(chenhaoruo0128@gmail.com) for reporting the issue"}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Pinot", "versions": [{"status": "affected", "version": "Apache Pinot", "versionType": "custom", "lessThanOrEqual": "0.10.0"}]}], "references": [{"url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h", "tags": ["x_refsource_MISC"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2022-09-23T08:05:13.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Apache Pinot would like to thank Haoruo Chen(chenhaoruo0128@gmail.com) for reporting the issue"}], "impact": [{}], "source": {"discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "Apache Pinot", "version_value": "0.10.0", "version_affected": "<="}]}, "product_name": "Apache Pinot"}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h", "name": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-26112", "STATE": "PUBLIC", "TITLE": "Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support", "ASSIGNER": "security@apache.org"}}}}, "cveMetadata": {"cveId": "CVE-2022-26112", "state": "PUBLISHED", "dateUpdated": "2025-05-27T14:46:56.726Z", "dateReserved": "2022-02-25T00:00:00.000Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2022-09-23T08:05:13.000Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Apache Pinot", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "0.10.0", "status": "affected", "version": "Apache Pinot", "versionType": "custom"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:*", "matchCriteriaId": "02C00685-B434-4A02-AADF-0D15F9E331DA", "versionEndExcluding": "0.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0"}, {"lang": "es", "value": "En versi\u00f3n 0.10.0 o en versiones anteriores de Apache Pinot, el punto final de consulta de Pinot y la capa de ingesti\u00f3n en tiempo real presentan una vulnerabilidad en entornos no protegidos debido al soporte de una funci\u00f3n groovy. Para evitar esto, hemos deshabilitado el soporte de la funci\u00f3n groovy por defecto desde la versi\u00f3n 0.11.0 de Pinot. V\u00e9ase https://docs.pinot.apache.org/basics/releases/0.11.0"}], "id": "CVE-2022-26112", "lastModified": "2026-06-17T04:34:42.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-26112", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-05-27T14:46:24.747770Z", "version": "2.0.3"}}]}, "published": "2022-09-23T08:15:08.780", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}