CVE-2021-27644
Assigner: apache
Published: 2021-11-01T09:15:10
State: PUBLISHED
affected: product: Apache DolphinScheduler
vendor: Apache Software Foundation
versions: lessThan: 1.3.6
status: affected
version: Apache DolphinScheduler
versionType: custom
credits: value: This issue was discovered by Jinchen Sheng of Ant FG Security Lab
descriptions: value: In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
metrics: other: content: other: low
type: unknown
problemTypes: descriptions: cweId: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
type: CWE
source: discovery: UNKNOWN
title: DolphinScheduler mysql jdbc connector parameters deserialize remote code execution
x_generator: engine: Vulnogram 0.0.9