CVE-2017-12630

creationtimestamp| type| source ---|---|--- 2026-03-05 02:40:03+00:00| seen| https://gist.github.com/aamixsh/3d5e1cb8dc17415acad151adc9c11e61...

org.apache.drill.contrib.storage-hive:drill-storage-hive-core (>=1.3.0, <=1.8.0), org.apache.drill.contrib:drill-gis (>=1.3.0, <=1.11.0) +12 more potentially affected by CVE-2017-12630 via org.apache.drill:drill-common (>=1.2.0, <=1.11.0)

org.apache.drill:drill-common MAVEN version =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.0, =1.3.0, =1.9.0, =1.2.0, =1.4.0, =1.4.0, =1.5.0, =1.4.0, =1.11.0 Source cves: CVE-2017-12630 Source advisory: OSV:GHSA-XP4G-5XJ6-6VPR...

org.apache.drill.contrib.storage-hive:drill-storage-hive-core (>=1.3.0, <=1.8.0), org.apache.drill.contrib:drill-gis (>=1.3.0, <=1.11.0) +12 more potentially affected by CVE-2017-12630 via org.apache.drill:drill-common (>=1.2.0, <=1.11.0)

org.apache.drill:drill-common MAVEN version =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.0, =1.3.0, =1.9.0, =1.2.0, =1.4.0, =1.4.0, =1.5.0, =1.4.0, =1.11.0 Source cves: CVE-2017-12630 Source advisory: GHSA-XP4G-5XJ6-6VPR...

CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

org.apache.drill.contrib.storage-hive:drill-storage-hive-core (>=1.3.0, <=1.8.0), org.apache.drill.contrib:drill-gis (>=1.3.0, <=1.11.0) +12 more potentially affected by CVE-2017-12630 via org.apache.drill:drill-common (>=1.2.0, <=1.11.0)

org.apache.drill:drill-common MAVEN version =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.0, =1.3.0, =1.9.0, =1.2.0, =1.4.0, =1.4.0, =1.5.0, =1.4.0, =1.11.0 Source cves: CVE-2017-12630 Source advisory: MEND:CVE-2017-12630...

CVE-2017-12630

CVE-2017-12630 affects Apache Drill 1.11.0 and earlier. The vulnerability is a cross-site scripting issue where submitting a form from the Query page allows an attacker to inject arbitrary script/HTML, which can then execute on the Profile page and potentially expose cookie information. The conne...