CVE-2021-44791: fallo en Apache Druid
Reflected XSS on certain HTTP endpoints
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.3%
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
Productos afectados
Apache Software Foundation · Apache DruidCVEs relacionadas — Apache Druid
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-25646—Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.EPSS 99.1%CVE-2021-36749—Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)EPSS 80.9%CVE-2021-26919—Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.EPSS 35.2%CVE-2021-26920—Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendedEPSS 9.5%CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.9%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.9%