CVE-2021-25646

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
Apache Software FoundationApache Druid>= 0.20.0 and earlier, <= 0.20.0

References

Timeline

Published
Jan 29, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-256475.4Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it toCVE-2021-256489.8Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features CVE-2021-256495.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerabiliCVE-2021-256508.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute speciaCVE-2021-256517.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate priviCVE-2021-256525.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform CVE-2021-256537.8A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially alCVE-2021-256547.8An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute spCVE-2021-256556.1A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site throughCVE-2021-256565.4Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated uCVE-2021-256577.8A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user toCVE-2021-256597.5A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Up