Executive brief
Code injection in Apache Druid
Affected products
- Maven org.apache.druid:druid
Junglewise Threat Intelligence
CVE-2021-25646: Code injection in Apache Druid
CVE-2021-25646 · Severity: low · CVSS 3.1 · Published 2021-06-16
Technologies: org.apache.druid:druid (Maven). Vendors: Maven.
Related threats
- Apache Druid’s Kerberos authenticator uses a weak fallback secret
- Apache Druid: Users can provide MySQL JDBC properties not on allow list
- Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters
- Apache Druid before 0.23.0 vulnerable to clickjacking
- Credentials bypass in Apache Druid