CVE-2024-23320CWE-20

Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

High · published February 23, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.

This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.

This issue affects Apache DolphinScheduler: until 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01388 · 72.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-02-23T16:57Z
EPSS history
Timeline
  • 23 FEB 16:57Z
    Apache DolphinScheduler: Arbitrary js execution as root for authenticated users
    cvelistv5