CVE-2023-49620: fallo en Apache DolphinScheduler
Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear Apache DolphinScheduler+ Monitorear org.apache.dolphinscheduler:dolphinscheduler-api
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 1.1%
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Productos afectados
Apache Software Foundation · Apache DolphinSchedulerCVEs relacionadas — Apache DolphinScheduler
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-30188HIGHApache DolphinScheduler: Resource File Read And Write VulnerabilityEPSS 6.0%CVE-2022-45462CRITICALApache DolphinScheduler prior to 2.0.5 have command execution vulnerabilityEPSS 2.9%CVE-2022-45875CRITICALApache DolphinScheduler: Remote command execution Vulnerability in script alert pluginEPSS 2.8%CVE-2023-49109CRITICALRemote Code Execution in Apache DolphinschedulerEPSS 2.3%CVE-2024-43202CRITICALApache DolphinScheduler: Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-25598—Apache DolphinScheduler user registration is vulnerable to ReDoS attacksEPSS 2.0%