// For flags

CVE-2023-49620

Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

Antes de la versión 3.1.0 de DolphinScheduler, el usuario que iniciaba sesión podía eliminar la función UDF en el centro de recursos sin autorización (que casi se usaba en tareas SQL), con vulnerabilidad de acceso no autorizado (IDOR), pero después de la versión 3.1.0 solucionamos este problema. Marcamos esta cve como nivel moderado porque todavía requiere el inicio de sesión del usuario para funcionar. Actualice a la versión 3.1.0 para evitar esta vulnerabilidad.

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

*Credits: Yuanheng Lab of zhongfu
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Complete
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-11-28 CVE Reserved
  • 2023-11-30 CVE Published
  • 2025-02-13 CVE Updated
  • 2025-04-15 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Dolphinscheduler
Search vendor "Apache" for product "Dolphinscheduler"
 < 3.1.0
Search vendor "Apache" for product "Dolphinscheduler" and version " < 3.1.0"
-
Affected