Vulnerability Details CVE-2021-27644
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Exploit prediction scoring system (EPSS) score
EPSS Score 0.021
EPSS Ranking 83.5%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.0
References
- http://www.openwall.com/lists/oss-security/2021/11/01/3
- https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/11/01/3
- https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
Products affected by CVE-2021-27644
-
cpe:2.3:a:apache:dolphinscheduler:1.0.0
-
cpe:2.3:a:apache:dolphinscheduler:1.0.1
-
cpe:2.3:a:apache:dolphinscheduler:1.0.2
-
cpe:2.3:a:apache:dolphinscheduler:1.0.3
-
cpe:2.3:a:apache:dolphinscheduler:1.0.4
-
cpe:2.3:a:apache:dolphinscheduler:1.0.5
-
cpe:2.3:a:apache:dolphinscheduler:1.1.0
-
cpe:2.3:a:apache:dolphinscheduler:1.2.0
-
cpe:2.3:a:apache:dolphinscheduler:1.2.1
-
cpe:2.3:a:apache:dolphinscheduler:1.3.0
-
cpe:2.3:a:apache:dolphinscheduler:1.3.1
-
cpe:2.3:a:apache:dolphinscheduler:1.3.2
-
cpe:2.3:a:apache:dolphinscheduler:1.3.3
-
cpe:2.3:a:apache:dolphinscheduler:1.3.4