dolphinschedulerGHSA-qwxx-xww6-8q8m
Remote Code Execution in Apache Dolphinscheduler
Critical9.8CVE-2023-49109 · Published Feb 20, 2024 · updated Aug 27, 2024
This issue affects Apache DolphinScheduler 3.0.0 before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 3.0.0, < 3.2.1 | 3.2.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2023-49109
More dolphinscheduler advisories
All dolphinscheduler| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 122024 | Apache DolphinScheduler: RCE by arbitrary js execution High8.8Aug 12, 2024 | High8.8 | 3.2.2 |
| Aug 122024 | Apache DolphinScheduler: Resource File Read And Write VulnerabilityHigh8.1Aug 12, 2024 | High8.1 | 3.2.2 |
| Feb 202024 | Improper Certificate Validation in Apache DolphinSchedulerHigh7.3Feb 20, 2024 | High7.3 | 3.2.1 |
| Feb 202024 | Arbitrary File Read Vulnerability in Apache DolphinschedulerHigh7.5Feb 20, 2024 | High7.5 | 3.2.1 |
| Feb 202024 | Session Fixation Apache DolphinSchedulerMediumFeb 20, 2024 | Medium | 3.2.1 |
| Nov 242023 | Apache DolphinScheduler sensitive information disclosureHigh7.5Nov 24, 2023 | High7.5 | 3.0.2 |