CVE-2021-26920

A flaw was found in druid. The HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the druid server process. The highest threat from this vulnerability is to data confidentiality...

Information Disclosure

druid-core is vulnerable to information disclosure. An attacker is able bypass the application-level restriction and read data from other sources than intended by passing a file URL to the HTTP InputSource...

CVE-2021-26920

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

CVE-2021-26920

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

CVE-2021-26920

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

Privilege escalation

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

CVE-2021-26920 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

CVE-2021-26920

The Apache Druid ingestion system contains a vulnerability in the HTTP InputSource component. Authenticated users can exploit this flaw to read data from unintended sources, such as the local file system , using the privileges of the Druid server process. While direct access to Druid provides a L...

CVE-2021-26920: Externally Controlled Reference to a Resource in Another Sphere

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

PT-2021-3992

Name of the Vulnerable Software and Affected Versions Apache Druid affected versions not specified Description The issue is related to weaknesses in the authorization mechanism of Apache Druid's analytical database. It allows remote attackers to gain unauthorized access to protected information...