Missing Authentication for Critical Function in Apache Calcite

🗓️ 22 Apr 2021 16:14:14Reported by GitHub Advisory DatabaseType

Missing Authentication in Apache Calcite HttpUtils#getURLConnection method for Druid and Splunk connection

Reporter	Title	Published	Views	Family All 15
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	29 Jun 202315:03	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple security vulnerabilities in Apache Storm used by IBM Tivoli Netcool Manager.	21 Jul 202204:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (June 2025)	19 Jun 202517:35	–	ibm
BDU FSTEC	The vulnerability of the `HttpUtils#getURLConnection` method in the Apache Calcite dynamic data management framework allows a attacker to execute a “man-in-the-middle” attack or gain unauthorized access to protected information.	6 Apr 202100:00	–	bdu_fstec
Circl	CVE-2020-13955	9 Oct 202016:33	–	circl
CNVD	Apache Calcite Clickjacking Vulnerability	11 Oct 202000:00	–	cnvd
CVE	CVE-2020-13955	9 Oct 202012:33	–	cve
Cvelist	CVE-2020-13955	9 Oct 202012:33	–	cvelist
EUVD	EUVD-2021-0835	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in IBM Qradar	23 Jun 202300:00	–	ncsc

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-13955
github	www.github.com/apache/calcite/commit/43eeafcbac29d02c72bd520c003cdfc571de2d15
issues	www.issues.apache.org/jira/browse/CALCITE-4298
lists	www.lists.apache.org/thread.html/r0b0fbe2038388175951ce1028182d980f9e9a7328be13d52dab70bb3%40%3Cdev.calcite.apache.org%3E
github	www.github.com/advisories/GHSA-hxp5-8pgq-mgv9

01 Feb 2023 05:05Current

0.4Low risk

Vulners AI Score0.4

CVSS 24.3

CVSS 3.15.9

EPSS0.00784