CVE-2023-49620CWE-862

Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

published November 30, 2023

CVSS
—
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01132 · 66.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-11-30T08:17Z
EPSS history
Timeline
  • 30 NOV 08:17Z
    Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
    cvelistv5