GitHub Advisoryadvisory · Maven

GHSA-xp4g-5xj6-6vpr Apache Drill vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-14 Modified 2022-11-08 Official page ↗
Aliases
CVE-2017-12630
Ecosystem
Maven
Packages
org.apache.drill:drill-common
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-08

Affected packages

• Maven org.apache.drill:drill-common: < 1.12.0 → fixed in 1.12.0

Description

In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

Related

Alias · CVE (1)

  • CVE-2017-12630 In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References