Apache AsterixDB is a highly scalable data management system that can store, index, and manage semi-structured data, e.g., much like MongoDB, but it also supports a full-power query language with the expressiveness of SQL (and more). Unlike analytics engines like Apache Hive or Apache Spark, it stores and manages data, so AsterixDB can exploit its knowledge of data partitioning and the availability of indexes to avoid always scanning data set(s) to process queries. Somewhat surprisingly, there is no open source parallel database system (relational or otherwise) available to developers today - AsterixDB aims to fill this need.
Apache AsterixDB suffers from a missing authentication vulnerability on its Cluster Controller HTTP API. Only the user-defined function endpoint is wrapped with authentication, while the query service and the /admin/shutdown endpoint are exposed with no authentication, so a remote attacker can execute SQL++ queries and shut down the cluster with no credentials. This results in unauthenticated data access and denial of service.