Description
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
Remediation
References
https://lists.apache.org/thread/t3nsq4crdr8wqgmj721d2wg6pf26s5cw
Related Vulnerabilities
CVE-2023-32993 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp
CVE-2019-10280 Vulnerability in maven package org.jenkins-ci.plugins:assembla-auth
CVE-2020-16044 Vulnerability in maven package org.webjars.npm:electron
CVE-2023-33201 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15to18
CVE-2017-12612 Vulnerability in maven package org.apache.spark:spark-core_2.10