Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yYzZoLXF3ajktMmM1M84AA5em

Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server.

This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.

This issue affects Apache DolphinScheduler: until 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.

Permalink: https://github.com/advisories/GHSA-rc6h-qwj9-2c53
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yYzZoLXF3ajktMmM1M84AA5em
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 2 months ago
Updated: 2 months ago

Identifiers: GHSA-rc6h-qwj9-2c53, CVE-2024-23320
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-23320
• https://github.com/apache/dolphinscheduler/pull/15487
• https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq
• https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp
• https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
• https://github.com/apache/dolphinscheduler/commit/ef9ed3db55cb1647886b06c2b2c6a5cfcdccfb5c
• http://www.openwall.com/lists/oss-security/2024/02/23/3
• https://github.com/advisories/GHSA-rc6h-qwj9-2c53

Repository: https://github.com/apache/dolphinscheduler
Blast Radius: 1.0

Affected Packages