Lucene search
GitHub Advisory DatabaseGHSA-WQG7-MX6P-2RW3HistoryNov 23, 2022 - 9:30 a.m.
Command injection in Apache DolphinScheduler Alert Plugins
2022-11-2309:30:24
CWE-77
GitHub Advisory Database
github.com
11
command injection
dolphinscheduler
alert plugins
logged-in users
upgrade
version 2.0.6
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.009
Percentile
82.7%
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher.
Affected configurations
Node
org.apache.dolphinschedulerdolphinscheduler-alert-pluginsRange<2.0.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| org.apache.dolphinscheduler | dolphinscheduler-alert-plugins | * | cpe:2.3:a:org.apache.dolphinscheduler:dolphinscheduler-alert-plugins:*:*:*:*:*:*:*:* |
Related
cvelist
cvelist
osv
osv
Command injection in Apache DolphinScheduler Alert Plugins
2022-11-23 09:30:24
CVE-2022-45462
2022-11-23 09:15:09
nvd
nvd
CVE-2022-45462
2022-11-23 09:15:09
cve
cve
CVE-2022-45462
2022-11-23 09:15:09
cnvd
cnvd
Apache DolphinScheduler Command Injection Vulnerability
2022-11-25 00:00:00
prion
prion
Command injection
2022-11-23 09:15:00
veracode
veracode
OS Command Injection
2022-11-24 06:07:30
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.009
Percentile
82.7%
Related for GHSA-WQG7-MX6P-2RW3