Cross-site Scripting (XSS)

2017-09-2707:11:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

39.7%

JSON

Apache Drill is vulnerable to cross-site scripting (XSS) attacks. The library does not properly sanitize the user input string in the query page or in the profile page, allowing a malicious user to inject and execute arbitrary Javascript.

CPENameOperatorVersion
drill : exec : java execution enginele1.11.0

CPE	Name	Operator	Version
	drill : exec : java execution engine	le	1.11.0

References

github.com/apache/drill/pull/935

issues.apache.org/jira/browse/DRILL-5766

0.001 Low

EPSS

Percentile

39.7%

JSON

Related for VERACODE:5178