Apache Dolphinscheduler vulnerabilities
27 known vulnerabilities affecting apache/dolphinscheduler.
Total CVEs
27
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL6HIGH14MEDIUM7
Vulnerabilities
Page 2 of 2
CVE-2020-13922P3MEDIUMCVSS 6.5v1.2.0v1.2.1+1 more2021-01-11
CVE-2020-13922 [MEDIUM] CWE-264 CVE-2020-13922: Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to over
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
nvd
CVE-2022-25598P3HIGHCVSS 7.5fixed in 2.0.52022-03-30
CVE-2022-25598 [HIGH] CWE-1333 CVE-2022-25598: Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS)
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
nvd
CVE-2022-26884P3MEDIUMCVSS 6.5fixed in 2.0.62022-10-28
CVE-2022-26884 [MEDIUM] CWE-22 CVE-2022-26884: Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
nvd
CVE-2023-49620P3MEDIUMCVSS 6.5fixed in 3.1.02023-11-30
CVE-2023-49620 [MEDIUM] CWE-862 CVE-2023-49620: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource cent
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version
nvd
CVE-2023-50270P3MEDIUMCVSS 6.5≥ 1.3.8, < 3.2.12024-02-20
CVE-2023-50270 [MEDIUM] CWE-613 CVE-2023-50270: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after th
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
nvd
CVE-2022-34662P4MEDIUMCVSS 6.5fixed in 3.0.02022-11-01
CVE-2022-34662 [MEDIUM] CWE-22 CVE-2022-34662: When users add resources to the resource center with a relation path will cause path traversal issue
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher
nvd
CVE-2023-25601P4MEDIUMCVSS 4.3≥ 3.0.0, < 3.1.22023-04-20
CVE-2023-25601 [MEDIUM] CWE-287 CVE-2023-25601: On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper auth
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-
nvd
← Previous2 / 2