AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

dolphinschedulerGHSA-qwxx-xww6-8q8m

Remote Code Execution in Apache Dolphinscheduler

dolphinscheduler

CVE-2023-49109 · Published Feb 20, 2024 · updated Aug 27, 2024

Critical9.8
Fix: upgrade to 3.2.1 or later
GitHub advisory

This issue affects Apache DolphinScheduler 3.0.0 before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.

Affected versions

PackageAffectedFixed in
org.apache.dolphinscheduler:dolphinscheduler
Maven
>= 3.0.0, < 3.2.13.2.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94
Also known as
CVE-2023-49109

More dolphinscheduler advisories

All dolphinscheduler
High 8.8Aug 12, 2024Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2High 8.1Aug 12, 2024Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2High 7.3Feb 20, 2024Improper Certificate Validation in Apache DolphinSchedulerCVE-2023-49250fixed in 3.2.1High 7.5Feb 20, 2024Arbitrary File Read Vulnerability in Apache DolphinschedulerCVE-2023-51770fixed in 3.2.1MediumFeb 20, 2024Session Fixation Apache DolphinSchedulerCVE-2023-50270fixed in 3.2.1High 7.5Nov 24, 2023Apache DolphinScheduler sensitive information disclosureCVE-2023-48796fixed in 3.0.2