GitHub Advisoryadvisory · Maven

GHSA-93g4-3phc-g4xw SQL injection in Apache DolphinScheduler

HIGH Published 2021-11-03 Modified 2021-11-03 Official page ↗
Aliases
CVE-2021-27644
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2021-11-02

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler-server: < 1.3.6 → fixed in 1.3.6

Description

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

Related

Alias · CVE (1)

  • CVE-2021-27644 In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References