Date: Thu, 07 Jul 2022 13:38:43 +0000 From: Abhishek Agarwal <abhishek@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2021-44791: Apache Druid: Reflected XSS on certain HTTP endpoints Severity: low Description: In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. Mitigation: Upgrade to Druid 0.23.0 or later. Credit: This issue was discovered by DangKhai from Viettel Cyber Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.