Vulnerability identifier: #VU50166

Vulnerability risk: Medium

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2021-25646

CWE-ID: CWE-94

Exploitation vector: Network

Exploits in database: 8

• April 14, 2023
  • CVE-2021-25646 () [Github]
• May 17, 2022
  • CVE-2021-25646 (CVE-2021-25646 Apache Druid 远程代码执行漏洞 Wker脚本) [Github]
• December 15, 2021
  • cve-2021-25646 (Apache Druid 远程代码执行;检测脚本) [Github]
• December 12, 2021
  • CVE-2021-25646 (Apache Druid remote code execution vulnerability - Apache Druid 远程代码执行漏洞利用 CVE-2021-25646) [Github]
• September 12, 2021
  • CVE-2021-25646-GUI (CSharp CVE-2021-25646-GUI) [Github]
• June 10, 2021
  • Apache-Druid-CVE-2021-25646 () [Github]
• May 9, 2021
  • Apache Druid 0.20.0 Remote Command Execution [Metasploit]
• March 18, 2021
  • PocList (Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-Exchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/RG-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthorized-RCE/TDOA-V11.7-GetOnlineCookie/VMware-vCenter-GetAnyFile/yongy [Github]

Impact: Code execution

Vulnerable software:
Apache Druid
Server applications / Database software

Vendor: Apache Foundation