CVE-2024-45384 — Information Exposure via Error Message in Apache Druid

CWE-209 — Information Exposure via Error MessageCWE-347 — Improper Verification of Cryptographic Signature4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 55.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache DruidApache Software Foundation Apache Druid
Timeline
PublishedSep 17

Description

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not using the druid-pac4j extension are not affected by this vulnerability. While we are not aware of a way to meaningfully exploit this flaw, we nevertheless recommend upgrading to version 30.0.1 or higher wh…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/druid0.18.0 — 30.0.1
▶CVEListV5apache_software_foundation/apache_druid0.18.0 — 30.0.0

🔴Vulnerability Details

3
OSV
druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability↗2024-09-17
▶
GHSA
druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability↗2024-09-17
▶
CVEList
Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack↗2024-09-17
▶
CVE-2024-45384 — Information Exposure via Error Message | cvebase