CVE-2021-27644 DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

2021-11-0109:15:10

CWE-264

apache

www.cve.org

cve-2021-27644

dolphinscheduler

mysql

jdbc

parameters

deserialize

remote code execution

apache

sql injection

AI Score

9.2

Confidence

High

EPSS

0.003

Percentile

71.0%

JSON

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

CNA Affected

[
  {
    "product": "Apache DolphinScheduler",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.3.6",
        "status": "affected",
        "version": "Apache DolphinScheduler",
        "versionType": "custom"
      }
    ]
  }
]