CVE-2023-49299

CWE-20 — Improper Input Validation5 documents4 sources
Severity
8.8HIGH
EPSS
0.6%
top 30.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache DolphinschedulerApache Dolphinscheduler
Timeline
PublishedDec 30
Latest updateFeb 23

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users↗2024-02-23
▶
CVEList
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users↗2023-12-30
▶
GHSA
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users↗2023-12-30
▶
OSV
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users↗2023-12-30
▶
CVE-2023-49299 (HIGH CVSS 8.8) | Improper Input Validation vulnerabi | cvebase.io