-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of MySQL JDBC URL parameters. The original filterSensitive function in MySQLSinkDTO.java contained logic to process URL parameters but had critical flaws: 1) It used URLDecoder.decode() in a loop without proper validation, enabling parameter injection through encoded payloads. 2) The parameter filtering logic for SENSITIVE_REPLACE_PARAM_MAP and SENSITIVE_REMOVE_PARAM_MAP could be bypassed through encoding or parameter manipulation. The patch moved this logic to MySQLSensitiveUrlUtils and added strict encoding checks, confirming the original implementation was vulnerable. The CWE-502 mapping and MySQL driver's known deserialization risks (autoDeserialize parameter) further validate this analysis.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.inlong:manager-pojo | maven | >= 1.5.0, < 1.10.0 | 1.10.0 |