Apache Software Foundation Apache Drill vulnerabilities

2 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Drill, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

PrioritiseCVE-2023-48362apache software foundation · apache drill +2 more2y agoApache Drill: XXE Vulnerability in XML Format ReaderXXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.CVSS9.8CriticalEPSS0.75%RoutineCVE-2017-12630apache software foundation · apache drill +2 more8y agoapache software foundation apache drillIn Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.CVSS5.4MediumEPSS1.10%