Threats tagged 'ghsa-33v5-488r-m83x'

AllData versions up to 0.7.1 contain an unauthenticated JDBC injection vulnerability in the data-dts /jobJdbcDatasource/test endpoint. This flaw allows remote attackers to supply arbitrary jdbcUrl and jdbcDriverClass parameters, potentially opening arbitrary database connections. By using a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server, attackers can read arbitrary files from the host running data-dts. The vulnerability has a high severity CVSS score of 8.7.