Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
General user can mint admin access tokens via /access-tokens
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
Incorrect Authorization vulnerability of /v2 experimental interface in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes. Users are recommended to upgrade to version [3.3.1], which fixes the issue.
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.
This issue affects Apache DolphinScheduler versions prior to 3.4.1.
Users are recommended to upgrade to version 3.4.1, which fixes this issue.
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.
This issue affects Apache DolphinScheduler versions 3.1..
Users are recommended to upgrade to:
version ≥ 3.2.0 if using 3.1.x
As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:
MANAGEMENTENDPOINTSWEBEXPOSUREINCLUDE=health,metrics,prometheus
Alternatively, add the following configuration to the application.yaml file:
management: endpoints: web: exposure: include: health,metrics,prometheus
This issue has been reported as CVE-2023-48796:
https://cveprocess.apache.org/cve5/CVE-2023-48796
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
Severity: important
Affected versions:
- Apache DolphinScheduler 3.0.0 before 3.2.2
Description:
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
Credit:
an4er (reporter)
References:
https://github.com/apache/dolphinscheduler/pull/15758 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2024-43202
File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.
Users are recommended to upgrade to version 3.2.2, which fixes the issue.
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.
Severity: important
Affected versions:
- Apache DolphinScheduler 3.1.0 before 3.2.2
Description:
File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.
Users are recommended to upgrade to version 3.2.2, which fixes the issue.
Credit:
L0ne1y (reporter) drun1baby (reporter) Zevi (reporter) Xun Bai (reporter)
References:
https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2024-30188
Severity: moderate
Affected versions:
- Apache DolphinScheduler through 3.2.1
Description:
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.
Credit:
yerest (reporter) L0ne1y (reporter) My Long (reporter)
References:
https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2024-29831
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Severity: important
Affected versions:
- Apache DolphinScheduler before 3.2.1
Description:
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Credit:
xuesong.zhou (finder) Nbxiglk (finder) Huang Atao (finder)
References:
https://github.com/apache/dolphinscheduler/pull/15487 https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2024-23320
Arbitrary File Read Vulnerability in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.1.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
This issue affects Apache DolphinScheduler: before 3.2.0.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.1.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Severity: important
Affected versions:
- Apache DolphinScheduler 3.0.0 before 3.2.1
Description:
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.1.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Credit:
Y4tacker and 4ra1n from Y4secTeam (finder)
References:
https://github.com/apache/dolphinscheduler/pull/14991 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2023-49109
Severity: important
Affected versions:
- Apache DolphinScheduler 1.3.8 through 3.2.0
Description:
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Credit:
lujiefsi (finder)
References:
https://github.com/apache/dolphinscheduler/pull/15219 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2023-50270
Severity: important
Affected versions:
- Apache DolphinScheduler 1.2.0 before 3.2.1
Description:
Arbitrary File Read Vulnerability in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.1.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Credit:
zhiwei (finder) rg (finder)
References:
https://github.com/apache/dolphinscheduler/pull/15433 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2023-51770
Severity: low
Affected versions:
- Apache DolphinScheduler through 3.2.0
Description:
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
This issue affects Apache DolphinScheduler: before 3.2.0.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
References:
https://github.com/apache/dolphinscheduler/pull/15288 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2023-49250
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.
Users are recommended to upgrade to version 3.1.9, which fixes the issue.
Severity: important
Affected versions:
- Apache DolphinScheduler through 3.1.9
Description:
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: through 3.1.9.
Users are recommended to upgrade to version 3.1.9, which fixes the issue.
Credit:
Eluen Siebene (finder)
References:
https://github.com/apache/dolphinscheduler/pull/15228 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2023-49299
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Severity: moderate
Affected versions:
- Apache DolphinScheduler 2.0.0 before 3.1.0
Description:
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized(which almost used in sql task), with unauthorized access vulnerability(IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Credit:
Yuanheng Lab of zhongfu (finder)
References:
https://github.com/apache/dolphinscheduler/pull/10307 https://dolphinscheduler.apache.org https://www.cve.org/CVERecord?id=CVE-2023-49620
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.