CVE-2024-23590

Session Fixation attack works by forcing a victim to use a pre-known session identifier before authentication. The application does not generate a new session identifier after successful user login, as a result the authenticated session remains associated with an identifier controlled by the attacker. After the victim logs in using the imposed identifier, the attacker can use it to gain full access to their account.

An attacker can hijack the session of an authenticated user, gaining access to their data and the ability to perform operations on their behalf, including reading and modifying analytical data stored in Apache Kylin.

Apache Kylin should be updated to version 5.0.0 or later, which contains a fix that eliminates this vulnerability.

Apache Kylin versions 2.0.0 through 4.x inclusive.