Skip to content
fr Sign in
Not rated

CVE-2023-48362 XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote…

Description

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.

Affected products and versions

Product Affected versions Fixed in
Apache Drill 1.19 1.19.0 → < 1.21.2 1.21.2
apache_drill 1.19 1.19.0 → < 1.21.2 1.21.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Drill

The 2 CVEs of Apache Drill →
CVE-2017-12630 In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or… Not rated
Track this CVE