CVE-2024-45384 is a Padding Oracle vulnerability in the optional druid-pac4j extension of Apache Druid, affecting versions 0.18.0 through 30.0.0. This flaw could allow an unauthenticated attacker to manipulate pac4j session cookies, though the practical impact is currently considered low. The vulnerability has a CVSS score of 5.3 MEDIUM, indicating a network-based attack with low complexity and a potential impact on integrity. There is no known active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.18.0, < 30.0.1CPE matchmatch criteria | cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.