GitHub Advisoryadvisory · Maven

GHSA-r44q-98gx-pmh2 Apache DolphinScheduler Missing Authorization vulnerability

MEDIUM Published 2023-11-30 Modified 2023-12-05 Official page ↗
Aliases
CVE-2023-49620
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler-api, org.apache.dolphinscheduler:dolphinscheduler-common, org.apache.dolphinscheduler:dolphinscheduler-dao, org.apache.dolphinscheduler:dolphinscheduler-service
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-862
Reviewed
2023-11-30

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler-api: < 3.1.0 → fixed in 3.1.0 • Maven org.apache.dolphinscheduler:dolphinscheduler-common: < 3.1.0 → fixed in 3.1.0 • Maven org.apache.dolphinscheduler:dolphinscheduler-dao: < 3.1.0 → fixed in 3.1.0 • Maven org.apache.dolphinscheduler:dolphinscheduler-service: < 3.1.0 → fixed in 3.1.0

Description

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

Related

Alias · CVE (1)

  • CVE-2023-49620 Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References