Read the docs
TI-2017-09355 Aliases CVE-2017-12630GHSA-xp4g-5xj6-6vpr

Cross-site scripting in Apache Drill

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

Why it matters now

EPSS 0.01242 69th percentileScored 2026-11-07
Fix Fixed org.apache.drill:drill-common (Maven): 1.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Drillup to 1.11.0—No fix listedCNA
—org.apache.drill:drill-common (Maven)before 1.12.01.12.0Patch availableGHSA-xp4g-5xj6-6vpr
  • Apache Drill VendorApache Affected up to 1.11.0 Fixed in — No fix listed CNA
  • org.apache.drill:drill-common (Maven) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-xp4g-5xj6-6vpr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:drill:*:*:*:*:*:*:*:*up to 1.11.0VulnerableApache
  • cpe:2.3:a:apache:drill:*:*:*:*:*:*:*:* Versions up to 1.11.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-xp4g-5xj6-6vpr org.apache.drill:drill-common (Maven) Fixed in 1.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12630
  2. 2026-10-03 Alias added: GHSA-xp4g-5xj6-6vpr

References

Advisory 1

Other 3

  • TI-2019-10766 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before… CVSS 3.1HIGH 7.5
  • TI-2023-26223 Apache Drill: XXE Vulnerability in XML Format Reader CVSS 3.1CRITICAL 9.8
  • TI-2010-05009 Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in… CVSS 3.1MEDIUM 6.1
  • TI-2019-07556 Cross-site scripting in Eclipse Jetty CVSS 3.1MEDIUM 6.1
  • TI-2019-00177 Missing authorization in Apache ZooKeeper CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences