CVE-2021-44791

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-447925.3Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerabiliCVE-2021-447938.6Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerabilCVE-2021-447945.3Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerCVE-2021-447955.3Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit thCVE-2021-44808.2Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissionsCVE-2021-44818.2Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissionsCVE-2021-448278.8There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExtCVE-2021-448287.8Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privilegeCVE-2021-448296.1Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.CVE-2021-448326.6Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code executionCVE-2021-448339.8The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.CVE-2021-448359.8An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sanitized. This causes SQ
CVE-2021-44791: Medium severity, CVSS 6.1 | Vulnix