Exploit for Injection in Apache Druid

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injecti...

CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

CVE-2020-1958: Improper Neutralization of Special Elements in Output Used by a Downstream Component

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

PT-2020-15191

Name of the Vulnerable Software and Affected Versions Apache Druid version 0.17.0 Description The issue allows callers of Druid APIs with valid LDAP credentials to bypass the credentialsValidator.userSearch filter, which determines if a valid LDAP user can authenticate with Druid. Although...