[<prev] [next>] [day] [month] [year] [list]
Message-ID: <780f3eb8-92fe-12c3-9e4f-d385ff6dd10d@apache.org>
Date: Thu, 07 Jul 2022 13:38:43 +0000
From: Abhishek Agarwal <abhishek@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-44791: Apache Druid: Reflected XSS on certain HTTP
endpoints
Severity: low
Description:
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
Mitigation:
Upgrade to Druid 0.23.0 or later.
Credit:
This issue was discovered by DangKhai from Viettel Cyber Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
