Description
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/01/3
https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
Related Vulnerabilities
CVE-2022-0401 Vulnerability in npm package w-zip
CVE-2019-10348 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook
CVE-2021-40111 Vulnerability in maven package org.apache.james:james-server
CVE-2021-46440 Vulnerability in npm package strapi
CVE-2021-41182 Vulnerability in maven package org.webjars:jquery-ui