CVE-2020-1958 – org.apache.druid:druid

Package

Manager: maven
Name: org.apache.druid:druid
Vulnerable Version: =0.17.0 || >=0.17.0 <0.17.1

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.15565 pctl0.94433

Details

Credentials bypass in Apache Druid When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

Metadata

Created: 2022-02-09T22:05:39Z
Modified: 2021-04-05T21:49:45Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-qh2g-7h5p-mxf4/GHSA-qh2g-7h5p-mxf4.json
CWE IDs: ["CWE-200", "CWE-74"]
Alternative ID: GHSA-qh2g-7h5p-mxf4
Finding: F310
Auto approve: 1