CVE-2023-48362 — Apache Drill: XXE Vulnerability in XML Format Reader
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. User…
Published: 2024-07-24 · CVSS: 9.8 · CVSS 3.1
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7