HIGH🇵🇱 Wersja polska

CVE-2021-26919

CVSS 8.8v3.1pub. 2021-03-30upd. 2024-11-21

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Druid

    APP
    Apache
    < 0.20.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-23906CRITICAL9.8PL ✓ten sam produkt

Apache Druid – pominięcie uwierzytelnienia LDAP przez anonimowy bind

CVE-2025-59390CRITICAL9.8PL ✓ten sam produkt

Apache Druid: słaby generator losowy umożliwia bypass uwierzytelnienia Kerberos

CVE-2021-25646HIGH8.8ten sam produkt

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of reques...

CVE-2025-27888MEDIUM5.8ten sam produkt

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input Durin...

CVE-2024-45384MEDIUM5.3ten sam produkt

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulat...