CVE-2021-27644

Published: Nov 1, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	affected `Apache DolphinScheduler - < 1.3.6`

Weaknesses (CWE)

CWE-264

References

https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E

x_refsource_MISC

[dolphinscheduler-dev] 20211101 CVE-2021-27644: Apache DolphinScheduler: DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

mailing-list

x_refsource_MLIST

[oss-security] 20211101 CVE-2021-27644: Apache DolphinScheduler: DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-27644

Description

Affected Products

Weaknesses (CWE)

References