Description
Apache Pinot 1.3 版本以下存在swagger-ui未授权访问漏洞，攻击者可利用该漏洞构造恶意请求接口造成服务器敏感信息泄露。
Apache Pinot 存在swagger-ui未授权访问漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/apache/pinot/issues/7900
https://docs.pinot.apache.org/release-0.12.1/basics/releases/0.9.2
https://lists.apache.org/thread/hsm0b2w8qr0sqy4rj1mfnnw286tslpzc
https://cloud.tencent.com/developer/article/2160217
https://juejin.cn/post/7294301361835720730
https://www.moonsec.com/4096.html
https://siembiot.eu/cyber-security-news/apache-pinot-vulnerability-let-remote-attackers-bypass-authentication/33296
https://securityonline.info/critical-vulnerability-discovered-in-apache-pinot-authentication-bypass-exposes-systems-to-severe-risk/