CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49299 – Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
https://notcve.org/view.php?id=CVE-2023-49299
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue. Vulnerabilidad de validación de entrada incorrecta en Apache DolphinScheduler. Un usuario autenticado puede hacer que se ejecute javascript arbitrario y sin espacio aislado en el servidor. Este problema afecta a Apache DolphinScheduler: hasta 3.1.9. • http://www.openwall.com/lists/oss-security/2024/02/23/3 https://github.com/apache/dolphinscheduler/pull/15228 https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49620 – Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
https://notcve.org/view.php?id=CVE-2023-49620
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability Antes de la versión 3.1.0 de DolphinScheduler, el usuario que iniciaba sesión podía eliminar la función UDF en el centro de recursos sin autorización (que casi se usaba en tareas SQL), con vulnerabilidad de acceso no autorizado (IDOR), pero después de la versión 3.1.0 solucionamos este problema. Marcamos esta cve como nivel moderado porque todavía requiere el inicio de sesión del usuario para funcionar. Actualice a la versión 3.1.0 para evitar esta vulnerabilidad. • http://www.openwall.com/lists/oss-security/2023/11/30/4 https://github.com/apache/dolphinscheduler/pull/10307 https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49068 – Apache DolphinScheduler: Information Leakage Vulnerability
https://notcve.org/view.php?id=CVE-2023-49068
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en Apache DolphinScheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. • https://github.com/apache/dolphinscheduler/pull/15192 https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-45875 – Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
https://notcve.org/view.php?id=CVE-2022-45875
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS. Validación incorrecta de los parámetros del complemento de alerta de script en Apache DolphinScheduler para evitar la vulnerabilidad de ejecución remota de comandos. Este problema afecta a Apache DolphinScheduler versión 3.0.1 y versiones anteriores; versión 3.1.0 y versiones anteriores. Este ataque solo lo pueden realizar usuarios autenticados que puedan iniciar sesión en DS. • http://www.openwall.com/lists/oss-security/2023/11/22/2 https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26885 – Apache DolphinScheduler config file read by task risk
https://notcve.org/view.php?id=CVE-2022-26885
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. Cuando se utilizan tareas para leer archivos de configuración, existe el riesgo de que se revele la contraseña de la base de datos. Le recomendamos actualizar a la versión 2.0.6 o superior. • https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp •