Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Druid

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2021-26919 EPSS 35%

    Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.

    Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if l…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • High 8.8
    CVE-2021-25646 Public exploit EPSS 99%

    Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

    Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possib…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven