Executive brief
Credentials bypass in Apache Druid
Affected products
- Maven org.apache.druid:druid
Junglewise Threat Intelligence
CVE-2020-1958: Credentials bypass in Apache Druid
CVE-2020-1958 · Severity: low · CVSS 3.1 · Published 2022-02-09
Technologies: org.apache.druid:druid (Maven). Vendors: Maven.
Related threats
- Apache Druid’s Kerberos authenticator uses a weak fallback secret
- Apache Druid: Users can provide MySQL JDBC properties not on allow list
- Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters
- Apache Druid before 0.23.0 vulnerable to clickjacking
- Arbitrary code execution in Apache Druid