Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/39222?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39222?format=api", "vulnerability_id": "VCID-fygf-x7uk-7uds", "summary": "Cross-site Scripting\nIn Apache Drill when submitting a form from the Query page, users are able to pass arbitrary script or HTML which will be rendered or executed on the Profile page. For example, after submitting script code that returns cookie information from the Query page, malicious users may obtain this information from the Profile page.", "aliases": [ { "alias": "CVE-2017-12630" }, { "alias": "GHSA-xp4g-5xj6-6vpr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/54772?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.12.0" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/214933?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214934?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.2.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214935?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.3.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214936?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.4.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.4.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214937?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.5.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214938?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.6.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.6.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214939?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.7.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.7.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214940?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.8.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214941?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.9.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.9.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/214942?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.10.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.10.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/54771?format=api", "purl": "pkg:maven/org.apache.drill/drill-common@1.11.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6amm-pfu5-6bf4" }, { "vulnerability": "VCID-fygf-x7uk-7uds" }, { "vulnerability": "VCID-krqp-stbs-e3cb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.drill/drill-common@1.11.0" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-12630", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0072", "scoring_system": "epss", "scoring_elements": "0.72864", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.0072", "scoring_system": "epss", "scoring_elements": "0.72849", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.0072", "scoring_system": "epss", "scoring_elements": "0.72886", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.0072", "scoring_system": "epss", "scoring_elements": "0.72893", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0072", "scoring_system": "epss", "scoring_elements": "0.72876", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-12630" }, { "reference_url": "https://github.com/apache/drill", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/drill" }, { "reference_url": "https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923@%3Cdev.drill.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/608658a55d09e16542db41121a0a972c97448214cdc04071fd4db923@%3Cdev.drill.apache.org%3E" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12630", "reference_id": "CVE-2017-12630", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12630" }, { "reference_url": "https://github.com/advisories/GHSA-xp4g-5xj6-6vpr", "reference_id": "GHSA-xp4g-5xj6-6vpr", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xp4g-5xj6-6vpr" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 79, "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "description": "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fygf-x7uk-7uds" }