CVE-2024-29831 Apache DolphinScheduler: RCE by arbitrary js execution

2024-08-0914:21:48

CWE-20

apache

github.com

apache dolphinscheduler

rce

input validation

AI Score

8.6

Confidence

High

EPSS

Percentile

9.5%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache_software_foundation:apache_dolphinscheduler:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache_software_foundation",
    "product": "apache_dolphinscheduler",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "3.2.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]