{"id":"CVE-2021-44791","published":"2022-07-07T18:35:16Z","modified":"2024-08-04T04:32:13Z","title":"Reflected XSS on certain HTTP endpoints","vendor":"Apache","product":"Apache Druid","tier":"tail","description":{"text":"In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02221,"percentile":0.82621,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://lists.apache.org/thread/lh2kcl4j45q7xj4w6rqf6kwf0mvyp2o6","tags":["x_refsource_MISC"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.52}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Druid","versions":[">= Apache Druid, <= 0.22.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.druid:druid","vulnerableRanges":["<0.23.0"],"patched":["0.23.0"],"from":["GHSA-8rmv-98m4-g5c6"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6296","exploited":false,"provenance":"source"}}