CVE-2020-1958
- State
- Published
- Severity
- Not scored
- Published
- Apr 1, 2020
- Updated
- Aug 4, 2024
- Reserved
- Dec 2, 2019
Description
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache DruidApache |
|
References
- https://lists.apache.org/thread.html/r9d437371793b410f8a8e18f556d52d4bb68e18c537962f6a97f4945e%40%3Cdev.druid.apache.org%3E
- [druid-commits] 20200401 [GitHub] [druid] lgtm-com[bot] commented on issue #9600: Fix for [CVE-2020-1958] Apache Druid LDAP injection vulnerabilitymailing-list
- [druid-commits] 20200401 [druid] branch master updated: Fix for [CVE-2020-1958]: Apache Druid LDAP injection vulnerability (#9600)mailing-list
- [druid-commits] 20200401 [GitHub] [druid] jihoonson merged pull request #9600: Fix for [CVE-2020-1958] Apache Druid LDAP injection vulnerabilitymailing-list
- [announce] 20200401 [CVE-2020-1958]: Apache Druid LDAP injection vulnerabilitymailing-list
- [druid-commits] 20200403 [GitHub] [druid] jon-wei opened a new pull request #9612: [Backport] Fix for [CVE-2020-1958]: Apache Druid LDAP injection vulnerability (#9600)mailing-list
- [druid-commits] 20200404 [GitHub] [druid] clintropolis merged pull request #9612: [Backport] Fix for [CVE-2020-1958]: Apache Druid LDAP injection vulnerability (#9600)mailing-list
- [druid-commits] 20200404 [druid] branch 0.18.0 updated: Fix for [CVE-2020-1958]: Apache Druid LDAP injection vulnerability (#9600) (#9612)mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.