CVE-2021-27644 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-server

Description

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

Remediation

References

http://www.openwall.com/lists/oss-security/2021/11/01/3

https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E

Related Vulnerabilities

CVE-2019-1003028 Vulnerability in maven package org.jenkins-ci.plugins:jms-messaging

CVE-2019-10418 Vulnerability in maven package io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps

CVE-2022-36599 Vulnerability in maven package net.mingsoft:ms-mcms

CVE-2021-23926 Vulnerability in maven package org.apache.xmlbeans:xmlbeans

CVE-2020-8840 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H