Skip to content
Sign in
Not rated

CVE-2017-12630 In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or…

Description

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

Affected products and versions

Product Affected versions Fixed in
Apache Drill Versions not published

Other CVEs of Apache Drill

The 2 CVEs of Apache Drill →
CVE-2023-48362 XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote… Not rated
Track this CVE