Vulnerability Details CVE-2024-23320
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.9%
CVSS Severity
CVSS v3 Score 8.8
References
- http://www.openwall.com/lists/oss-security/2024/02/23/3
- https://github.com/apache/dolphinscheduler/pull/15487
- https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq
- https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp
- https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
- http://www.openwall.com/lists/oss-security/2024/02/23/3
- https://github.com/apache/dolphinscheduler/pull/15487
- https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq
- https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp
- https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
Products affected by CVE-2024-23320
-
cpe:2.3:a:apache:dolphinscheduler:1.0.0
-
cpe:2.3:a:apache:dolphinscheduler:1.0.1
-
cpe:2.3:a:apache:dolphinscheduler:1.0.2
-
cpe:2.3:a:apache:dolphinscheduler:1.0.3
-
cpe:2.3:a:apache:dolphinscheduler:1.0.4
-
cpe:2.3:a:apache:dolphinscheduler:1.0.5
-
cpe:2.3:a:apache:dolphinscheduler:1.1.0
-
cpe:2.3:a:apache:dolphinscheduler:1.2.0
-
cpe:2.3:a:apache:dolphinscheduler:1.2.1
-
cpe:2.3:a:apache:dolphinscheduler:1.3.0
-
cpe:2.3:a:apache:dolphinscheduler:1.3.1
-
cpe:2.3:a:apache:dolphinscheduler:1.3.2
-
cpe:2.3:a:apache:dolphinscheduler:1.3.3
-
cpe:2.3:a:apache:dolphinscheduler:1.3.4
-
cpe:2.3:a:apache:dolphinscheduler:1.3.6
-
cpe:2.3:a:apache:dolphinscheduler:1.3.8
-
cpe:2.3:a:apache:dolphinscheduler:1.3.9
-
cpe:2.3:a:apache:dolphinscheduler:2.0.0
-
cpe:2.3:a:apache:dolphinscheduler:2.0.1
-
cpe:2.3:a:apache:dolphinscheduler:2.0.2
-
cpe:2.3:a:apache:dolphinscheduler:2.0.3
-
cpe:2.3:a:apache:dolphinscheduler:2.0.4
-
cpe:2.3:a:apache:dolphinscheduler:2.0.5
-
cpe:2.3:a:apache:dolphinscheduler:2.0.6
-
cpe:2.3:a:apache:dolphinscheduler:2.0.7
-
cpe:2.3:a:apache:dolphinscheduler:2.0.8
-
cpe:2.3:a:apache:dolphinscheduler:2.0.9
-
cpe:2.3:a:apache:dolphinscheduler:3.0.0
-
cpe:2.3:a:apache:dolphinscheduler:3.0.1
-
cpe:2.3:a:apache:dolphinscheduler:3.0.2
-
cpe:2.3:a:apache:dolphinscheduler:3.0.3
-
cpe:2.3:a:apache:dolphinscheduler:3.0.4
-
cpe:2.3:a:apache:dolphinscheduler:3.0.5
-
cpe:2.3:a:apache:dolphinscheduler:3.0.6
-
cpe:2.3:a:apache:dolphinscheduler:3.1.0
-
cpe:2.3:a:apache:dolphinscheduler:3.1.1
-
cpe:2.3:a:apache:dolphinscheduler:3.1.2
-
cpe:2.3:a:apache:dolphinscheduler:3.1.3
-
cpe:2.3:a:apache:dolphinscheduler:3.1.4
-
cpe:2.3:a:apache:dolphinscheduler:3.1.5
-
cpe:2.3:a:apache:dolphinscheduler:3.1.6
-
cpe:2.3:a:apache:dolphinscheduler:3.1.7
-
cpe:2.3:a:apache:dolphinscheduler:3.1.8
-
cpe:2.3:a:apache:dolphinscheduler:3.1.9
-
cpe:2.3:a:apache:dolphinscheduler:3.2.0