GHSA-xp4g-5xj6-6vpr

ghsaUSosv

Apache Drill vulnerable to Cross-site Scripting

view advisory published 2022-05-14Licence: CC-BY-4.0

In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-12630US	medium5.4	1.10% (65th)	—	2017-12-18
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example:…

references

External citations — patches, advisories, analysis.

https://github.com/apache/drillPACKAGE
https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923@%3Cdev.drill.apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2017-12630ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan