Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
CVE-2022-45875

9.8CRITICAL

Key Information:

Vendor
Apache
Status
Apache Dolphinscheduler
Vendor
CVE Published:
4 January 2023

Summary

The vulnerability in Apache DolphinScheduler arises from improper validation of script alert plugin parameters, which may lead to remote command execution attacks. This security flaw specifically affects authenticated users who can log in to DolphinScheduler, allowing them to exploit the issue on versions up to 3.1.0 and earlier. It's crucial for users and administrators to implement the recommended patches and monitor access to mitigate potential risks.

Affected Version(s)

Apache DolphinScheduler 3.0 <= 3.0.1

Apache DolphinScheduler 3.1 <= 3.1.0

References

https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3j...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/11/22/2

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

4ra1n of Chaitin Tech
.