HIGH🇬🇧 English

CVE-2021-26919

CVSS 8.8v3.1pub. 2021-03-30upd. 2024-11-21

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Druid

    APP
    Apache
    < 0.20.2
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2026-23906CRITICAL9.8PL ✓ten sam produkt

Apache Druid – pominięcie uwierzytelnienia LDAP przez anonimowy bind

CVE-2025-59390CRITICAL9.8PL ✓ten sam produkt

Apache Druid: słaby generator losowy umożliwia bypass uwierzytelnienia Kerberos

CVE-2021-25646HIGH8.8ten sam produkt

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of reques...

CVE-2025-27888MEDIUM5.8ten sam produkt

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input Durin...

CVE-2024-45384MEDIUM5.3ten sam produkt

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulat...