CVE-2023-49620: Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49620?
This vulnerability is marked as moderate level.
How can an authenticated user delete UDFs in the DolphinScheduler resource center?
Before version 3.1.0, authenticated users could delete UDFs in the resource center unauthorized. This issue has been fixed in version 3.1.0.
What is the vulnerability ID for unauthorized access in the DolphinScheduler resource center?
The vulnerability ID for unauthorized access in the DolphinScheduler resource center is IDOR (Insecure Direct Object Reference).
Which versions of DolphinScheduler are affected by CVE-2023-49620?
Versions up to exclusive 3.1.0 of DolphinScheduler are affected by CVE-2023-49620.
Where can I find more information about CVE-2023-49620?
You can find more information about CVE-2023-49620 in the following references: [link1], [link2], [link3].