Description
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/01/3
https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
Related Vulnerabilities
CVE-2022-0528 Vulnerability in npm package @uppy/companion
CVE-2023-40037 Vulnerability in maven package org.apache.nifi:nifi-dbcp-base
CVE-2019-10433 Vulnerability in maven package com.ztbsuper:dingding-notifications
CVE-2020-15231 Vulnerability in maven package org.mapfish.print:print-servlet
CVE-2019-10424 Vulnerability in maven package com.technicolor:eloyente