insightsoftware Spark JDBC Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability exists in the insightsoftware Spark JDBC driver version 2.6.21 and prior. This issue arises from the ability of attackers to inject malicious parameters into the JDBC URL. When the JDBC driver uses this URL to connect to the database, it triggers JNDI injection, which can lead to remote code execution.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where the affected JDBC driver is used.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
6.4remediation
0.0relevance
0.0threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.