Read the docs
TI-2021-20275 Aliases CVE-2021-44791GHSA-8rmv-98m4-g5c6

Reflected XSS on certain HTTP endpoints

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

Why it matters now

EPSS 0.02275 83rd percentileScored 2026-11-07
Fix Fixed org.apache.druid:druid (Maven): 0.23.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache DruidApache Druid – 0.22.1—No fix listedCNA
—org.apache.druid:druid (Maven)before 0.23.00.23.0Patch availableGHSA-8rmv-98m4-g5c6
  • Apache Druid VendorApache Affected Apache Druid – 0.22.1 Fixed in — No fix listed CNA
  • org.apache.druid:druid (Maven) Vendor— Affected before 0.23.0 Fixed in 0.23.0 Patch available GHSA-8rmv-98m4-g5c6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*up to 0.22.1VulnerableApache
  • cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* Versions up to 0.22.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-8rmv-98m4-g5c6 org.apache.druid:druid (Maven) Fixed in 0.23.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44791
  2. 2026-10-03 Alias added: GHSA-8rmv-98m4-g5c6

References

Advisory 2

Other 1

  • TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
  • TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
  • TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
  • TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
  • TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
  • TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences