CVE-2024-23320
published 2024-02-23CVE-2024-23320: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.39%
69.1th percentile
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | dolphinscheduler | < 3.2.1 | 3.2.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
osv·2024-02-23·CVSS 8.8
CVE-2024-23320 [HIGH] Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
GHSA
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
ghsa·2024-02-23·CVSS 8.8
CVE-2024-23320 [HIGH] CWE-20 Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2024/02/23/3https://github.com/apache/dolphinscheduler/pull/15487https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqqhttps://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cphttps://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmhttp://www.openwall.com/lists/oss-security/2024/02/23/3https://github.com/apache/dolphinscheduler/pull/15487https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqqhttps://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cphttps://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
2024-02-23
Published