Remote Code Execution (RCE)

2024-08-2607:08:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

remote code execution

insufficient validation

user input

httptaskdefinitionparser.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

JSON

org.apache.dolphinscheduler:dolphinscheduler-task-api is vulnerable to Remote Code Execution. The vulnerability is due to insufficient validation of user input within the HttpTaskDefinitionParser.java file, allowing attackers to execute arbitrary code on the affected system.