CVE-2022-45875 Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin

2023-01-0414:57:45

CWE-20

apache

www.cve.org

apache dolphinscheduler

remote command execution vulnerability

script alert plugin

improper validation

cve-2022-45875

authenticated users

version 3.0.1

version 3.1.0

AI Score

9.7

Confidence

High

EPSS

0.003

Percentile

65.6%

JSON

Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache DolphinScheduler",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "3.0.1",
        "status": "affected",
        "version": "3.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.1.0",
        "status": "affected",
        "version": "3.1",
        "versionType": "custom"
      }
    ]
  }
]