CVE-2021-44791: Reflected XSS on certain HTTP endpoints
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-44791?
CVE-2021-44791 is a vulnerability in Apache Druid 0.22.1 and earlier versions that allows for reflected XSS attacks through specially-crafted links.
What is the severity of CVE-2021-44791?
The severity of CVE-2021-44791 is medium, with a CVSS score of 6.1.
How does CVE-2021-44791 affect Apache Druid?
CVE-2021-44791 affects Apache Druid 0.22.1 and earlier versions by allowing unescaped URL parameters to be sent back in HTML responses, enabling reflected XSS attacks.
How can I fix CVE-2021-44791?
To fix CVE-2021-44791, it is recommended to upgrade to a version of Apache Druid that is not affected by the vulnerability.
Where can I find more information about CVE-2021-44791?
More information about CVE-2021-44791 can be found at the following link: [https://lists.apache.org/thread/lh2kcl4j45q7xj4w6rqf6kwf0mvyp2o6]