CVE-2017-12630

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-12630
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12630.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-12630
Aliases
Published
2017-12-18T14:29:00.243Z
Modified
2026-03-14T09:21:46.377418Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.

References

Affected packages

Git /

Affected ranges

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12630.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.11.0"
            }
        ]
    }
]