CVE-2021-45457Overly broad CORS configuration
- 7.5HighCVSS base score
- 2.5%Exploitation in 30 daysEPSS · top 15% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Timeline
ID reserved
By apache
- 16 days later
· 16 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.5% · top 15% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
Apache Software Foundation · Apache Kylin
- affected Apache Kylin 2 – ≤ 2.6.6
- affected Apache Kylin 3 – ≤ 3.1.2
- affected Apache Kylin 4 – ≤ 4.0.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.kylin:kylinGHSA-mgpf-hhgf-cxg4 (opens in a new tab)
What to do
Workaround: Kylin reflects the `Origin` header and allow credentials to be sent cross-origin in the default configuration. The preflight OPTIONS request: ``` OPTIONS /kylin/api/projects HTTP/1.1 Host: localhost:7070 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0 Accept: */* Accept-Language: en-US Accept-Encoding: gzip, deflate Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Referer: http://b49b-95-62-58-48.ngrok.io/ Origin: http://b49b-95-62-58-48.ngrok.io Connection: keep-alive Cache-Control: max-age=0 ``` Will be replied with: ``` HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Access-Control-Allow-Origin: http://b49b-95-62-58-48.ngrok.io Access-Control-Allow-Credentials: true Vary: Origin Access-Control-Allow-Methods: DELETE, POST, GET, OPTIONS, PUT Access-Control-Allow-Headers: Authorization, Origin, No-Cache, X-Requested-With, Cache-Control, Accept, X-E4m-With, If-Modified-Since, Pragma, Last-Modified, Expires, Content-Type Content-Length: 0 ``` Users of Kylin 2.x & Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1782. Users of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1781.
References
References2
- https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m (opens in a new tab)x_refsource_MISCx_transferred
- [oss-security] 20220106 CVE-2021-45457: Apache Kylin: Overly broad CORS configuration (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-0646 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-mgpf-hhgf-cxg4 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-45457)Record last updated .