CVE-2021-27644

DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

State: Published
Severity: Not scored
Published: Nov 1, 2021
Updated: Aug 3, 2024
Reserved: Feb 24, 2021

Description

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

Scores

The record has no CVSS score.

Weaknesses

CWE-264 Permissions, Privileges, and Access Controls

Affected Products

Product	Versions
Apache DolphinSchedulerApache Software Foundation	Apache DolphinScheduler to before 1.3.6Affected

References

https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
[oss-security] 20211101 CVE-2021-27644: Apache DolphinScheduler: DolphinScheduler mysql jdbc connector parameters deserialize remote code executionmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.