CVE-2026-111613
CVE-2026-111613 · AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
CVSS 8.7 · Alta · EPSS 0,6%
- Publicación
- Actualización
Productos y versiones afectados
alldata
- Versiones
- ≥ 0, ≤ 0.7.1: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135
- https://github.com/alldatacenter/alldata
- https://www.vulncheck.com/advisories/alldata-through-0.7.1-unauthenticated-jdbc-injection-via-jobjdbcdatasource-test
- https://nvd.nist.gov/vuln/detail/CVE-2026-111613