GitHub Advisoryadvisory · Maven

GHSA-8rmv-98m4-g5c6 Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters

MEDIUM Published 2022-07-08 Modified 2022-07-19 Official page ↗
Aliases
CVE-2021-44791
Ecosystem
Maven
Packages
org.apache.druid:druid
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-08

Affected packages

• Maven org.apache.druid:druid: < 0.23.0 → fixed in 0.23.0

Description

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. This issue is patched in version 0.23.0.

Related

Alias · CVE (1)

  • CVE-2021-44791 In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References