CVE-2024-43115: Apache DolphinScheduler: Alert Script Attack
Published Sep 3, 2025
·Updated
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.
This issue affects Apache DolphinScheduler: before 3.2.2.
Users are recommended to upgrade to version 3.3.1, which fixes the issue.
Affected Software
3 affected componentsFixes available
Apache Dolphinscheduler<3.2.2
Apache Dolphinscheduler<3.2.2
maven/org.apache.dolphinscheduler:dolphinscheduler<3.2.2
3.2.2
Event History
Sep 3, 2025
CVE Published
via MITRE·08:38 AM
Data Sourced
via MITRE·08:38 AM
DescriptionWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Sep 9, 2025
Advisory Published
via GitHub·06:31 PM
Data Sourced
via GitHub·06:31 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-43115?
CVE-2024-43115 has a moderate severity level due to the potential for authenticated users to execute arbitrary shell scripts.
2
How do I fix CVE-2024-43115?
To fix CVE-2024-43115, upgrade Apache DolphinScheduler to version 3.3.1 or later.
3
Who is affected by CVE-2024-43115?
CVE-2024-43115 affects all versions of Apache DolphinScheduler before 3.2.2.
4
What type of vulnerability is CVE-2024-43115?
CVE-2024-43115 is categorized as an Improper Input Validation vulnerability.
5
What could happen if CVE-2024-43115 is exploited?
If exploited, CVE-2024-43115 could allow an authenticated user to execute arbitrary shell scripts on the server.