SQL Injection

2023-10-1708:05:30

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

input validation

datanodecontroller

inlongclustercontroller

misleading records

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

38.5%

JSON

org.apache.inlong: manager-web is vulnerable to SQL Injection. The vulnerability is due to a lack of Input Validation in the testConnection function in both DataNodeController.java and InlongClusterController.java. This allows an attacker to create misleading or false records that can potentially leads to SQL Injection.