GHSA-xp4g-5xj6-6vpr
Apache Drill vulnerable to Cross-site Scripting
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.drill:drill-common | < 1.12.0 | 1.12.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
References
External links from the advisory. They lead to third-party sites.