Description

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

Remediation

References

https://lists.apache.org/thread/t3nsq4crdr8wqgmj721d2wg6pf26s5cw

Related Vulnerabilities

CVE-2023-37952 Vulnerability in maven package com.mabl.integration.jenkins:mabl-integration

CVE-2016-2510 Vulnerability in maven package org.apache-extras.beanshell:bsh

CVE-2020-5407 Vulnerability in maven package org.springframework.security:spring-security-saml2-service-provider

CVE-2021-33609 Vulnerability in maven package com.vaadin:vaadin-server

CVE-2019-10373 Vulnerability in maven package org.jenkins-ci.plugins:build-pipeline-plugin

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Mailing List Vendor Advisory CWE-1021