Detections
Analytics
SCA: security update for org.apache.druid:druid (GHSA-wrqf-rrrw-w3mg)
high Tenable Self-Hosted Container Security Plugin ID 420105
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of
requests. This functionality is intended for use in high-trust environments, and is disabled by default.
However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted
request that forces Druid to run user-provided JavaScript code for that request, regardless of server
configuration. This can be leveraged to execute code on the target machine with the privileges of the
Druid server process. (CVE-2021-25646)
See Also
Plugin Details
Severity: High
ID: 420105
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.12
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2021-25646
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/16/2021
Vulnerability Publication Date: 1/29/2021
Exploitable With
Metasploit (Apache Druid 0.20.0 Remote Command Execution)
Reference Information
CVE: CVE-2021-25646
cwe: CWE-732