Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview org.apache.calcite.avatica:avatica-core is a JDBC driver framework Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the instantiatePlugin process. An attacker can trigger the execution of static...

Arbitrary Code Execution

avatica-core is vulnerable to arbitrary code execution. The vulnerability exists due to the getInstance function of AvaticaHttpClientFactoryImpl.java does not properly verify the HTTP client classes before being instantiating, allowing an attacker to inject and execute malicious code through the...