Apache Drill vulnerabilities

6 CVEs affecting Apache Drill, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-48362, published 2024-07-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-5312, published 2014-11-24. Medium severity, CVSS 6.1. EPSS: 18.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
CVE-2019-14439, published 2019-07-30. High severity, CVSS 7.5. EPSS: 10.8% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally…
CVE-2019-0201, published 2019-05-23. Medium severity, CVSS 5.9. EPSS: 9.7% chance of exploitation in the next 30 days. An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and…
CVE-2019-10241, published 2019-04-22. Medium severity, CVSS 6.1. EPSS: 9.4% chance of exploitation in the next 30 days. In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the…
CVE-2017-12630, published 2017-12-18. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting…
CVE-2023-48362, published 2024-07-24. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to…