{"id":"CVE-2017-12630","aliases":["EUVD-2022-5833","GHSA-xp4g-5xj6-6vpr"],"status":"published","title":"Apache Drill vulnerable to Cross-site Scripting","description":"In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01242,"percentile":0.69414,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-12-18T14:00:00Z","modified":"2026-06-17T01:03:40Z","fixes":[{"ecosystem":"Maven","package":"org.apache.drill:drill-common","fixed_in":["1.12.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.drill:drill-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.drill:drill-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"versions":["1.1.0","1.10.0","1.11.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0"]}],"products":[{"vendor":"apache","product":"drill"},{"vendor":"apache software foundation","product":"apache drill"}],"references":[{"url":"https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12630","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xp4g-5xj6-6vpr"},{"url":"https://github.com/apache/drill","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-12630","description":"In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.","status":"published","published":"2017-12-18T14:00:00Z","modified":"2024-09-16T20:16:31.531Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2022-5833","description":"In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.","status":"published","published":"2017-12-18T14:00:00Z","modified":"2024-09-16T20:16:31Z","updated_at":"2026-11-03T00:55:15.468069Z"}],"ghsa":[{"id":"GHSA-xp4g-5xj6-6vpr","title":"Apache Drill vulnerable to Cross-site Scripting","description":"In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.","status":"published","published":"2022-05-14T03:53:41Z","modified":"2023-01-29T05:03:45Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:25.835323Z"}],"nvd":[{"id":"CVE-2017-12630","description":"In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.","status":"published","published":"2017-12-18T14:29:00.243Z","modified":"2026-06-17T01:03:40.34Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"GHSA-xp4g-5xj6-6vpr","title":"Apache Drill vulnerable to Cross-site Scripting","description":"In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.","status":"published","published":"2022-05-14T03:53:41Z","modified":"2023-11-08T03:58:53.853793Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}