CVE-2024-29831CWE-20

Apache DolphinScheduler: RCE by arbitrary js execution

High · published August 9, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
67.3
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01175 · 67.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-08-09T14:21Z
EPSS history
Timeline
  • 09 AUG 14:21Z
    Apache DolphinScheduler: RCE by arbitrary js execution
    cvelistv5