cve.bz

CVE-2017-12630

5.4 mediumEPSS 1.1%

Medium (5.4) in apache drill. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in org.apache.drill:drill-common 1.12.0.

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

Severity

CVSS 3.0

5.4 medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xp4g-5xj6-6vprMavenorg.apache.drill:drill-common<1.12.01.12.0

References

Check your stackJSON