CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:drill:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-12-18 14:29

Updated : 2024-02-04 19:29


NVD link : CVE-2017-12630

Mitre link : CVE-2017-12630

CVE.ORG link : CVE-2017-12630


JSON object : View

Products Affected

apache

  • drill
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')