CVE-2025-70828

CVE-2025-70828 摘要 在 Datart v1.0.0-rc.3 中发现了一个任意文件读取漏洞。该应用程序在数据源配置期间未能正确验证 JDBC 连接 URL。 漏洞详情 漏洞类型： 不当输入验证（CWE-20）/ 任意文件读取 受影响版本： Datart v1.0.0-rc.3 严重程度： 高危（可能导致敏感信息泄露） 描述 该漏洞存在于数据源配置模块中。应用程序未严格清理 JDBC 配置中的 url 参数。具有数据源配置权限的远程攻击者可以向 JDBC URL 注入恶意参数（特别是 allowLoadLocalInfile=true）。 通过将 JDBC...

GHSA-8M84-H9HH-3CFH Apache SeaTunnel SQL Injection vulnerability

Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360 This issue affects Apache SeaTunnel: 1.0.0. Users...

CVE-2023-43668

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or...

CVE-2023-43668: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or...

Arbitrary File Read

OpenRefine is vulnerable to Arbitrary File Read. The vulnerability due to improper jdbc url sanitization, which allows an attacker to set the allowLoadLocalInfile value to true by passing it through the databaseName parameter. This can be exploited to read sensitive internal server files...

CVE-2022-44644

In Apache Linkis =1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be...

PT-2023-1346 · Apache +1 · Apache Linkis +1

Name of the Vulnerable Software and Affected Versions: Apache Linkis versions prior to 1.3.1 Description: The issue is related to insufficient protection of service data when handling the allowLoadLocalInfile parameter with a value of true in the MySQL Connector/J component of Apache Linkis. This...

CVE-2022-44644: Improper Input Validation

In Apache Linkis =1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be...