Dolphinscheduler
CVE-2024-43202
CRITICAL
GHSA-2fm6-mv57-p2qh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 36 maven packages depend on org.apache.dolphinscheduler:dolphinscheduler-task-api (25 direct, 11 indirect)
Ecosystem-wide dependent count for version 3.1.0.
DescriptionNVD
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
AnalysisAI
Exposure of Remote Code Execution in Apache Dolphinscheduler.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Exposure of Remote Code Execution in Apache Dolphinscheduler.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue. Affected products include: Apache Dolphinscheduler. Version information: before 3.2.2..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
More in Dolphinscheduler
View allFile read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resou
Alarm instance management has command injection when there is a specific command configured. Rated critical severity (CV
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing my
Privilege escalation in Apache DolphinScheduler before 3.4.2 allows any authenticated general user to generate admin-lev
Improper Input Validation vulnerability in Apache DolphinScheduler. Rated high severity (CVSS 8.8), this vulnerability i
Improper Input Validation vulnerability in Apache DolphinScheduler. Rated high severity (CVSS 8.8), this vulnerability i
Improper Input Validation vulnerability in Apache DolphinScheduler. Rated high severity (CVSS 8.8), this vulnerability i
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. Rate
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.2.1. Rated high seve
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. Rated high severity
When using tasks to read config files, there is a risk of database password disclosure. Rated high severity (CVSS 7.5),
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache Dol
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today