-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of MySQL JDBC connection parameters in Apache SeaTunnel's JDBC connector. The高危 parameters (allowLoadLocalInfile, allowUrlInLocalInfile) are known to enable local file read capabilities in MySQL when combined. The functions responsible for constructing JDBC URLs likely accepted these parameters without validation in v1.0.0. The high-confidence entry points to the connection factory method where URL parameters are processed, while the medium-confidence entry addresses URL assembly logic. Both align with CWE-552's file exposure pattern and the attack vector described in the advisory.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.seatunnel:seatunnel | maven | = 1.0.0 | 1.0.1 |