CVE-2023-49620: Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
First published: Thu Nov 30 2023(Updated: )
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache DolphinScheduler | <3.1.0 | |
| maven/org.apache.dolphinscheduler:dolphinscheduler-service | <3.1.0 | 3.1.0 |
| maven/org.apache.dolphinscheduler:dolphinscheduler-dao | <3.1.0 | 3.1.0 |
| maven/org.apache.dolphinscheduler:dolphinscheduler-common | <3.1.0 | 3.1.0 |
| maven/org.apache.dolphinscheduler:dolphinscheduler-api | <3.1.0 | 3.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/dolphinscheduler/pull/10307
- https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
- http://www.openwall.com/lists/oss-security/2023/11/30/4
- https://nvd.nist.gov/vuln/detail/CVE-2023-49620
- https://github.com/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530ac
- https://github.com/advisories/GHSA-r44q-98gx-pmh2 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-49620?
This vulnerability is marked as moderate level.
How can an authenticated user delete UDFs in the DolphinScheduler resource center?
Before version 3.1.0, authenticated users could delete UDFs in the resource center unauthorized. This issue has been fixed in version 3.1.0.
What is the vulnerability ID for unauthorized access in the DolphinScheduler resource center?
The vulnerability ID for unauthorized access in the DolphinScheduler resource center is IDOR (Insecure Direct Object Reference).
Which versions of DolphinScheduler are affected by CVE-2023-49620?
Versions up to exclusive 3.1.0 of DolphinScheduler are affected by CVE-2023-49620.
Where can I find more information about CVE-2023-49620?
You can find more information about CVE-2023-49620 in the following references: [link1], [link2], [link3].
- collector/oss-sec
- alias/CVE-2023-49620
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-r44q-98gx-pmh2
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/remedy
- agent/title
- agent/severity
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache dolphinscheduler
- package-manager/maven