CVE-2020-1958

apache druid

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-1958

Katalog CVE

CVSS 6.5 · Medium EPSS 4,6%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada apache druid. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

Rincian

Terbit di NVD
1 April 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
4,6% peluang dieksploitasi; lebih tinggi dari 91,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache druid Versi 0.17.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.