Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2021-44791 · ADVISORY
• apache/druid · PACKAGE
• lists.apache.org/thread/lh2kcl4j45q7xj4w6rqf6kwf0mvyp2o6 · WEB

Lỗ hổng khác của org.apache.druid:druid

• CVE-2025-59390NGHIÊM TRỌNG 9.8Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configu…
• CVE-2025-27888TRUNG BÌNH 5.4Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-…
• CVE-2024-45537TRUNG BÌNH 6.5Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted us…
• CVE-2022-28889TRUNG BÌNH 4.3In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent click…
• CVE-2021-26919CAO 8.8Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper …