CVE-2024-45537

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide for their JDBC connections. By default, this allowed properties list restricts users to TLS-related properties only. However, when configuration a MySQL JDBC connection, users can use a particularly-crafted JDBC connection string to provide properties that are not on this allow list. Users without the permission to configure JDBC connections are not able to exploit this vulnerability. CVE-2021-26919 describes a similar vulnerability which was partially addressed in Apache Druid 0.20.2. This issue is fixed in Apache Druid 30.0.1.

• CWE-20

• https://lists.apache.org/thread/2ovx1t77y6tlkhk5b42clp4vwo4c8cjvVendor Advisory

Published

Sep 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45522Linen before cd37c3e does not verify that the domain is line…9.8
• CVE-2024-45523An issue was discovered in Bravura Security Fabric versions …9.1
• CVE-2024-45526An issue was discovered in OPC Foundation OPCFoundation/UA-.…5.3
• CVE-2024-45527REDCap 14.7.0 allows HTML injection via the project title of…6.1
• CVE-2024-45528CodeAstro MembershipM-PHP (aka Membership Management System …5.4
• CVE-2024-4553The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…5.4
• CVE-2024-45538Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Fr…9.6
• CVE-2024-45539Out-of-bounds write vulnerability in cgi components in Synol…7.5
• CVE-2024-4554Improper Input Validation vulnerability in OpenText NetIQ Ac…5.4
• CVE-2024-45540Memory corruption while invoking IOCTL map buffer request fr…6.6
• CVE-2024-45541Memory corruption when IOCTL call is invoked from user-space…7.8
• CVE-2024-45542Memory corruption when IOCTL call is invoked from user-space…7.8