CVE-2025-61735

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-61735
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh Issue Tracking Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/09/30/9
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*
History

04 Nov 2025, 22:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/09/30/9 -
References () https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh - Vendor Advisory, Issue Tracking () https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh - Issue Tracking, Vendor Advisory

03 Oct 2025, 18:50

Type Values Removed Values Added
References () https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh - () https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh - Vendor Advisory, Issue Tracking
First Time Apache
Apache kylin
CPE cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*

02 Oct 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.3

02 Oct 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-02 10:15

Updated : 2025-11-04 22:16

NVD link : CVE-2025-61735

Mitre link : CVE-2025-61735

CVE.ORG link : CVE-2025-61735

JSON object : View

Products Affected

apache

  • kylin
CWE
CWE-918

Server-Side Request Forgery (SSRF)