Arbitrary JavaScript Execution Vulnerability in Apache DolphinScheduler
CVE-2023-49299

8.8HIGH

Key Information:

Vendor
Apache
Status
Apache Dolphinscheduler
Vendor
CVE Published:
30 December 2023

Summary

An improper input validation vulnerability has been identified in Apache DolphinScheduler, allowing authenticated users to execute arbitrary, unsandboxed JavaScript on the server. This flaw affects versions prior to 3.1.9. To mitigate risks associated with this vulnerability, it is crucial for users to upgrade to the patched version, 3.1.9, as it addresses this security issue.

Affected Version(s)

Apache DolphinScheduler 0 < 3.1.9

References

https://github.com/apache/dolphinscheduler/pull/15228
patch
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfs...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/02/23/3

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eluen Siebene
.