Lucene search

GoogleOSV:CVE-2023-49299

HistoryDec 30, 2023 - 5:15 p.m.

CVE-2023-49299

2023-12-3017:15:07

Google

osv.dev

apache dolphinscheduler

input validation

vulnerability

authenticated user

javascript

upgrade

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

49.7%

JSON

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.

Users are recommended to upgrade to version 3.1.9, which fixes the issue.

References

www.openwall.com/lists/oss-security/2024/02/23/3

github.com/apache/dolphinscheduler/pull/15228

lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

49.7%

JSON

Related for OSV:CVE-2023-49299