Cross-Site Scripting (XSS)

apache-drill is vulnerable to cross-site scripting XSS. The inputValues parameter in populateAndShowAlert function is not properly sanitized, allowing a remote attacker attacker to pass a malicious input to execute arbitrary Javascript code on the victims browser...

Information Disclosure

Apache Drill is vulnerable to information disclosure. The application logs passwords in plain text when connecting a database, allowing a malicious user with access to the logs access to sensitive information...

Directory Traversal

Apache Drill is vulnerable directory traversal attacks. The application is does not prevent user queries from accessing paths outside of their workspace, allowing a malicious user to traverse the directory...

Apache Drill Cross-Site Scripting Vulnerability

Apache Drill is a schema-less SQL query engine for Hapood, NoSQL and cloud storage from the Apache Apache Software Foundation. The product supports a variety of NoSQL databases and file systems , including HBase, MongoDB, MapR-DB, HDFS and MapR-FS and so on. A cross-site scripting vulnerability...

CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

Design/Logic Flaw

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

org.apache.drill.contrib.storage-hive:drill-storage-hive-core (>=1.3.0, <=1.8.0), org.apache.drill.contrib:drill-gis (>=1.3.0, <=1.11.0) +12 more potentially affected by CVE-2017-12630 via org.apache.drill:drill-common (>=1.2.0, <=1.11.0)

org.apache.drill:drill-common MAVEN version =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.9.0, =1.3.0, =1.9.0, =1.2.0, =1.4.0, =1.4.0, =1.5.0, =1.4.0, =1.11.0 Source cves: CVE-2017-12630 Source advisory: MEND:CVE-2017-12630...

CVE-2017-12630

CVE-2017-12630 affects Apache Drill 1.11.0 and earlier. The vulnerability is a cross-site scripting issue where submitting a form from the Query page allows an attacker to inject arbitrary script/HTML, which can then execute on the Profile page and potentially expose cookie information. The conne...

PT-2017-12611

Name of the Vulnerable Software and Affected Versions Apache Drill versions 1.11.0 and earlier Description The issue allows users to pass arbitrary script or HTML when submitting a form from the Query page, which takes effect on the Profile page afterwards. For example, a malicious user can submi...

CVE-2017-12630: Improper Neutralization of Input During Web Page Generation

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

Spoofable Clients

Apache Drill clients are vulnerable to being spoofed. When authenticating with a server, the configuration is not checked. This means if an attacker sets up a drillbit url with no authentication to spoof requests coming from a secured drillbit url, the connection will return as a success...

Cross-site Scripting (XSS)

Apache Drill is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input string in the query page or in the profile page, allowing a malicious user to inject and execute arbitrary Javascript...