Vulnerability Details CVE-2021-27644
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 79.0%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.0
References
- http://www.openwall.com/lists/oss-security/2021/11/01/3
- https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
- https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/11/01/3
- https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
- https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E
Products affected by CVE-2021-27644
-
cpe:2.3:a:apache:dolphinscheduler:1.0.0
-
cpe:2.3:a:apache:dolphinscheduler:1.0.1
-
cpe:2.3:a:apache:dolphinscheduler:1.0.2
-
cpe:2.3:a:apache:dolphinscheduler:1.0.3
-
cpe:2.3:a:apache:dolphinscheduler:1.0.4
-
cpe:2.3:a:apache:dolphinscheduler:1.0.5
-
cpe:2.3:a:apache:dolphinscheduler:1.1.0
-
cpe:2.3:a:apache:dolphinscheduler:1.2.0
-
cpe:2.3:a:apache:dolphinscheduler:1.2.1
-
cpe:2.3:a:apache:dolphinscheduler:1.3.0
-
cpe:2.3:a:apache:dolphinscheduler:1.3.1
-
cpe:2.3:a:apache:dolphinscheduler:1.3.2
-
cpe:2.3:a:apache:dolphinscheduler:1.3.3
-
cpe:2.3:a:apache:dolphinscheduler:1.3.4