CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

CVE-2020-1958

Apache Druid 0.17.0 is affected by CVE-2020-1958, which allows an attacker using valid LDAP credentials to bypass the credentialsValidator.userSearch filter and proceed to authentication, while still being subjected to RBAC if configured. The issue also enables retrieval of LDAP attribute values ...

PT-2020-15191

Name of the Vulnerable Software and Affected Versions Apache Druid version 0.17.0 Description The issue allows callers of Druid APIs with valid LDAP credentials to bypass the credentialsValidator.userSearch filter, which determines if a valid LDAP user can authenticate with Druid. Although...

CVE-2020-1958: Improper Neutralization of Special Elements in Output Used by a Downstream Component

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

UBUNTU-CVE-2019-9086

HotelDruid before v2.3.1 has SQL Injection via the /visualizzatabelle.php anno parameter...

CVE-2019-8937

HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php...