Advisoriesby IbisdolphinschedulerGHSA-3vcp-r62v-xpvg
Apache DolphinScheduler vulnerable to Alert Script Attack
Fix: upgrade to 3.2.2 or later
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.
This issue affects Apache DolphinScheduler: before 3.2.2.
Users are recommended to upgrade to version 3.3.1, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | < 3.2.2 | 3.2.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20
- Also known as
- CVE-2024-43115
More dolphinscheduler advisories
All dolphinscheduler
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerabilityCVE-2025-62233fixed in 3.3.1Apache DolphinScheduler has an Incorrect Authorization VulnerabilityCVE-2026-23902fixed in 3.4.1Apache DolphinScheduler vulnerable to sensitive information disclosureCVE-2025-62188fixed in 3.2.0Apache DolphinScheduler Incorrect Default Permissions VulnerabilityCVE-2024-43166fixed in 3.3.1Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2