Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the concatenateForRewrite method in JettyUtils when the management proxy is enabled - which it is in the default configuration. An attacker can manipulate the URL to redirect requests to an arbitrary...

Clickjacking

org.apache.druid:druid-server is vulnerable to clickjacking. The server does not set appropriate headers to prevent clickjacking, which allows remote attackers to trick a user into thinking they are visiting a different site while being redirected to a malicious attacker controlled web site...

CVE-2021-25646: Undefined Security Weakness

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a...