CVE-2024-23320

CWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGH
EPSS
0.7%
top 27.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache DolphinschedulerApache Dolphinscheduler
Timeline
PublishedFeb 23

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
Apache DolphinScheduler: Arbitrary js execution as root for authenticated users↗2024-02-23
▶
OSV
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users↗2024-02-23
▶
GHSA
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users↗2024-02-23
▶
CVE-2024-23320 (HIGH CVSS 8.8) | Improper Input Validation vulnerabi | cvebase.io