GCVE - cpe:2.3:a:alldatacenter:alldata:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:alldatacenter:alldata:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-111613`	vulnerable	2026-11-03 10:16:11.016420	AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test HIGH (7.5) AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host. Published: 2026-10-16T17:38:52.517Z Updated: 2026-10-23T18:39:50.789Z Open on db.gcve.eu Reference links https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124 https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135 https://github.com/alldatacenter/alldata	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.