CVE-2024-23320

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23320
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/02/23/3 Mailing List Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15487 Issue Tracking Patch
https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq Vendor Advisory
https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp Vendor Advisory
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/23/3 Mailing List Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15487 Issue Tracking Patch
https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq Vendor Advisory
https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp Vendor Advisory
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
History

18 Mar 2025, 17:54

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/02/23/3 - () http://www.openwall.com/lists/oss-security/2024/02/23/3 - Mailing List, Third Party Advisory
References () https://github.com/apache/dolphinscheduler/pull/15487 - () https://github.com/apache/dolphinscheduler/pull/15487 - Issue Tracking, Patch
References () https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq - () https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq - Vendor Advisory
References () https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp - () https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp - Vendor Advisory
References () https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm - () https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm - Vendor Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
First Time Apache
Apache dolphinscheduler

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. (en) Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Information

Published : 2024-02-23 17:15

Updated : 2025-03-18 17:54

NVD link : CVE-2024-23320

Mitre link : CVE-2024-23320

CVE.ORG link : CVE-2024-23320

JSON object : View

Products Affected

apache

  • dolphinscheduler
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo