CVE-2024-23320 – org.apache.dolphinscheduler:dolphinscheduler-master

Package

Manager: maven
Name: org.apache.dolphinscheduler:dolphinscheduler-master
Vulnerable Version: >=0 <3.2.1

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00736 pctl0.71949

Details

Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.

Metadata

Created: 2024-02-23T18:30:59Z
Modified: 2025-02-13T19:12:14Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-rc6h-qwj9-2c53/GHSA-rc6h-qwj9-2c53.json
CWE IDs: ["CWE-20"]
Alternative ID: GHSA-rc6h-qwj9-2c53
Finding: F184
Auto approve: 1