Vulnerability · Published Dec 18, 2020 · Assigned by apache
CVE-2020-11974
Critical 9.8
In plain English
A critical-severity security flaw in Apache DolphinScheduler(Incubating). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.1% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)8.1%top 5.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.dolphinscheduler:dolphinscheduler | 1.3.0 | GHSA-jpj4-5xwp-cv23 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache DolphinScheduler(Incubating) | Apache DolphinScheduler(Incubating) 1.2.0 and 1.2.1 |
References
- https://lists.apache.org/thread.html/rcbe4c248ef0c566e99fd19388a6c92aeef88167286546b675e9b1769%40%3Cdev.dolphinscheduler.apache.org%3E
- [dolphinscheduler-commits] 20210223 [GitHub] [incubator-dolphinscheduler] sonarcloud[bot] commented on pull request #4851: [FIX-CVE-2020-11974] fix MySQLDataSource Security mailing-list
- [dolphinscheduler-commits] 20210223 [GitHub] [incubator-dolphinscheduler] CalvinKirs opened a new pull request #4851: [FIX-CVE-2020-11974] fix MySQLDataSource Security mailing-list
- [dolphinscheduler-commits] 20210223 [GitHub] [incubator-dolphinscheduler] sonarcloud[bot] removed a comment on pull request #4851: [FIX-CVE-2020-11974] fix MySQLDataSource Security mailing-list
- [dolphinscheduler-commits] 20210316 [GitHub] [incubator-dolphinscheduler] CalvinKirs opened a new pull request #5063: [1.3.6-prepare][#4851]fix MySQL datasource jdbc connect parameters #4851 mailing-list
- [oss-security] 20240409 CVE-2024-31864: Apache Zeppelin: Remote code execution by adding malicious JDBC connection string mailing-list