Vulnerabilities

Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying…

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set.

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerabili…

Apache Druid allows users with certain permissions to read data from other database systems using JDBC.

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j.

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking.

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses.

In the Druid ingestion system, the InputSource is used for reading data from a certain data source.

In the Druid ingestion system, the InputSource is used for reading data from a certain data source.

Apache Druid allows users to read data from other database systems using JDBC.

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests.

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is…