CVE-2022-45875
published 2023-01-04CVE-2022-45875: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache…
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.55%
83.2th percentile
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | dolphinscheduler | < 3.0.2 | 3.0.2 |
| apache | dolphinscheduler | — | — |
| apache_software_foundation | apache_dolphinscheduler | 3.0 – 3.0.1 | — |
| apache_software_foundation | apache_dolphinscheduler | 3.1 – 3.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache DolphinScheduler vulnerable to Improper Input Validation
ghsa·2023-01-04
CVE-2022-45875 [CRITICAL] CWE-20 Apache DolphinScheduler vulnerable to Improper Input Validation
Apache DolphinScheduler vulnerable to Improper Input Validation
Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.
OSV
Apache DolphinScheduler vulnerable to Improper Input Validation
osv·2023-01-04
CVE-2022-45875 [CRITICAL] Apache DolphinScheduler vulnerable to Improper Input Validation
Apache DolphinScheduler vulnerable to Improper Input Validation
Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.
OSV
CVE-2022-45875: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability
osv·2023-01-04
CVE-2022-45875 CVE-2022-45875: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-04
Published