CVE-2023-49299CWE-20

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

High · published December 30, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.

Users are recommended to upgrade to version 3.1.9, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01430 · 72.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-12-30T16:27Z
EPSS history
Timeline
  • 30 DEC 16:27Z
    Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
    cvelistv5