GitHub Advisoryadvisory · Maven

GHSA-3xh5-8hvq-rc8x Apache DolphinScheduler vulnerable to Improper Input Validation

CRITICAL Published 2023-01-04 Modified 2025-02-13 Official page ↗
Aliases
CVE-2022-45875
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-01-06

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler: < 3.0.2 → fixed in 3.0.2 • Maven org.apache.dolphinscheduler:dolphinscheduler: >= 3.1.0, < 3.1.1 → fixed in 3.1.1

Description

Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.

Related

Alias · CVE (1)

  • CVE-2022-45875 Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References