Enhancement: cves/2021/CVE-2021-25646.yaml by mp

cves/2021/CVE-2021-25646.yaml

@@ -1,17 +1,17 @@
 id: CVE-2021-25646
 
 info:
-  name: Apache Druid RCE
+  name: Apache Druid - Remote Code Execution
   author: pikpikcu
   severity: high
   description: |
-    Apache Druid is a column-oriented open source distributed data storage written in Java, designed to quickly obtain large amounts of event data and provide low-latency queries on the data.
-    Apache Druid lacks authorization and authentication by default. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
+    Apache Druid is susceptible to remote code execution because it lacks authorization and authentication by default. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
   reference:
     - https://paper.seebug.org/1476/
     - https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
     - http://www.openwall.com/lists/oss-security/2021/01/29/6
     - https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25864
   classification:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 8.8
@@ -82,3 +82,5 @@ requests:
         regex:
           - "root:.*:0:0:"
         part: body
+
+# Enhanced by mp on 2022/06/27