Published: 30/12/2023 Updated: 23/02/2024

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 0

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache dolphinscheduler

oss-sec mailing list archives   By Date By Thread </form>    CVE-2023-49299: Apache DolphinScheduler: Arbitrary js execute as root for authenticated users  <!-- ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2024-23320: Apache DolphinScheduler: Arbitrary js execution as root for authenticated users  <! ...

CWE-20 https://github.com/apache/dolphinscheduler/pull/15228 https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm http://www.openwall.com/lists/oss-security/2024/02/23/3 https://nvd.nist.gov https://seclists.org/oss-sec/2023/q4/347

CVE-2023-49299

Vulnerability Summary

Vulnerability Trend

Mailing Lists

References

Vulmon Search

About

Products

Connect