CVE-2022-45875: Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.
Other sources
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-45875?
CVE-2022-45875 is a vulnerability in Apache DolphinScheduler that allows remote command execution due to improper validation of script alert plugin parameters.
What versions of Apache DolphinScheduler are affected by CVE-2022-45875?
CVE-2022-45875 affects Apache DolphinScheduler version 3.0.1 and prior versions, as well as version 3.1.0 and prior versions.
How severe is CVE-2022-45875?
CVE-2022-45875 has a severity rating of 9.8 (Critical).
How can I fix CVE-2022-45875?
To fix CVE-2022-45875, users should upgrade to version 3.0.2 or later for Apache DolphinScheduler 3.0.1, and version 3.1.1 or later for Apache DolphinScheduler 3.1.0.
Where can I find more information about CVE-2022-45875?
More information about CVE-2022-45875 can be found at the following reference: [Apache mailing list](https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r).