description: In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
problem types: XSS Vulnerability
affected:
{
product: Apache Drill
vendor: Apache Software Foundation
versions:
status: affected, version: 1.11.0 and earlier
}