CVE-2024-23320: Apache DolphinScheduler: Arbitrary js execution as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.dolphinscheduler:dolphinscheduler-masterto a version that resolves this vulnerability.Fixed in 3.2.1 - Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.2.1 - Compensating control
If you cannot upgrade immediately, limit access so only trusted users can authenticate to Apache DolphinScheduler, since the vulnerability requires an authenticated user to achieve arbitrary unsandboxed server-side JavaScript execution as root.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23320?
CVE-2024-23320 is classified as a high severity vulnerability due to its potential for executing arbitrary, unsandboxed JavaScript on the server.
How do I fix CVE-2024-23320?
To mitigate CVE-2024-23320, users should upgrade to version 3.2.1 of Apache DolphinScheduler.
Who is affected by CVE-2024-23320?
Authenticated users of Apache DolphinScheduler versions prior to 3.2.1 are affected by CVE-2024-23320.
What type of vulnerability is CVE-2024-23320?
CVE-2024-23320 is an Improper Input Validation vulnerability.
Is CVE-2024-23320 related to any previous vulnerabilities?
Yes, CVE-2024-23320 is a legacy issue from CVE-2023-49299, which was not fully resolved.