CVE-2022-45462 Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability

2022-11-2300:00:00

CWE-77

apache

www.cve.org

cve-2022-45462

apache dolphinscheduler

command execution

vulnerability

upgrade

AI Score

Confidence

High

EPSS

0.009

Percentile

82.7%

JSON

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache DolphinScheduler",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "2.0.5",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]