CVE-2020-1958 - CVE House

Back to Database

Status published Medium CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers...

6.5 CVSS

Vulnerability Description

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-1958

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Apache

View All →

GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}

Regular expression Denial of Service in MooTools

Improper validation of certificate with host mismatch in Apache Log4j...

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism...

Affected Vendor

Apache

View all reports →

Affected Software

Apache Druid

Vulnerable Versions:

0.17.0

Timeline

Official Publish: April 1st, 2020

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.