CVE-2023-29055

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials.

To avoid this threat, users are recommended to

* Always turn on HTTPS so that network payload is encrypted.

* Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers.

* Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jan 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290565.9A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must CVE-2023-290578.8A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to CVE-2023-290586.5A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message CVE-2023-290597.83CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18 CVE-2023-29066.5Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptib CVE-2023-290605.7The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor wit CVE-2023-290615.2There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this CVE-2023-290623.8The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action with CVE-2023-290632.4The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PC CVE-2023-290644.3The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the applicat CVE-2023-290654.3The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical CVE-2023-290663.5The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account