Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yZm02LW12NTctcDJxaM4AA-yo

Apache Dolphinscheduler Code Injection vulnerability

Exposure of Remote Code Execution in Apache Dolphinscheduler.

This issue affects Apache DolphinScheduler: before 3.2.2.

We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.

Permalink: https://github.com/advisories/GHSA-2fm6-mv57-p2qh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yZm02LW12NTctcDJxaM4AA-yo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-2fm6-mv57-p2qh, CVE-2024-43202
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-43202
• https://github.com/apache/dolphinscheduler/pull/15758
• https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5
• https://lists.apache.org/thread/qbhk9wqyxhrn4z7m4m343wqxpwg926nh
• https://www.cve.org/CVERecord?id=CVE-2023-49109
• https://github.com/apache/dolphinscheduler/commit/dc306bfa1d3ed72eb7b72b177e33a46042d2a9c3
• https://github.com/advisories/GHSA-2fm6-mv57-p2qh

Repository: https://github.com/apache/dolphinscheduler
Blast Radius: 17.8

Affected Packages