AllData versions up to 0.7.1 contain an unauthenticated JDBC injection flaw in the /jobJdbcDatasource/test endpoint. By supplying arbitrary jdbcUrl and jdbcDriverClass parameters, a remote attacker can open arbitrary JDBC connections. The vulnerability allows the attacker to use a MySQL JDBC URL with allowLoadLocalInfile=true, pointing to an attacker-controlled server to read arbitrary files from the data-dts host. This flaw matches CWE-306 for missing authentication, enabling unauthenticated database access and file system read capabilities.

The affected product is AllData by AllDataCenter, specifically all releases through 0.7.1. No patch or update version is listed, so any installation of 0.7.1 or earlier is vulnerable.

The CVSS score of 8.7 reflects a high severity impact. EPSS data is not available, but the vulnerability is unauthenticated and can be triggered remotely via HTTP, making it easy for attackers to exploit. The issue is not listed in the CISA KEV catalog. The likely attack vector is a direct HTTP request to the /jobJdbcDatasource/test endpoint without requiring authentication, allowing malicious input to gain database and file system access.