What is GHSA-xp4g-5xj6-6vpr?

GHSA-xp4g-5xj6-6vpr is a security advisory published by GitHub Security Advisories with Medium severity. Apache Drill vulnerable to Cross-site Scripting

Which CVE IDs does GHSA-xp4g-5xj6-6vpr cover?

GHSA-xp4g-5xj6-6vpr covers the following CVE IDs: CVE-2017-12630. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xp4g-5xj6-6vpr?

GHSA-xp4g-5xj6-6vpr has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-xp4g-5xj6-6vpr?

GHSA-xp4g-5xj6-6vpr affects 1 product, including: maven/org.apache.drill:drill-common:\u003c 1.12.0.

GHSA-xp4g-5xj6-6vprMediumCVSS 5.4

Apache Drill vulnerable to Cross-site Scripting

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2017-12630 →

📋 Description

In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

🎯 Affected products1

maven/org.apache.drill:drill-common:< 1.12.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-12630
https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923@%3Cdev.drill.apache.org%3E
https://github.com/advisories/GHSA-xp4g-5xj6-6vpr