Apache DolphinScheduler vulnerable to Improper Input Validation

CVE-2022-45875 · Published Jan 4, 2023 · updated Feb 13, 2025

Critical9.8

Fix: upgrade to 3.0.2 or later (2 fixed versions below)

Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.

Affected versions

Package	Affected	Fixed in
org.apache.dolphinscheduler:dolphinscheduler Maven	< 3.0.2	3.0.2
	>= 3.1.0, < 3.1.1	3.1.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20
Also known as: CVE-2022-45875, PYSEC-2023-4

More dolphinscheduler advisories

All dolphinscheduler

Critical 9.8Feb 20, 2024

Remote Code Execution in Apache DolphinschedulerCVE-2023-49109fixed in 3.2.1 High 7.5Nov 24, 2023

Apache DolphinScheduler sensitive information disclosureCVE-2023-48796fixed in 3.0.2 Medium 6.5Nov 1, 2022

Apache DolphinScheduler vulnerable to Path TraversalCVE-2022-34662fixed in 3.0.0 Medium 6.5Oct 28, 2022

Apache DolphinScheduler vulnerable to Path TraversalCVE-2022-26884fixed in 2.0.6 High 7.5Mar 31, 2022

Uncontrolled Resource Consumption in Apache DolphinSchedulerCVE-2022-25598fixed in 2.0.5 Critical 9.8Feb 9, 2022

Remote code execution in DolphinSchedulerCVE-2020-11974fixed in 1.3.0