apache/druid · Security
Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters
- GHSA ID
- GHSA-8rmv-98m4-g5c6
- CVE ID
- CVE-2021-44791
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. This issue is patched in version 0.23.0.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')