critical9.8
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
Impact
This issue affects Apache DolphinScheduler 3.0.0 before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.dolphinscheduler:dolphinscheduler | >= 3.0.0, < 3.2.1 | 3.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Dolphinscheduler | from 3.0.0 before 3.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2024/02/20/4
- https://github.com/apache/dolphinscheduler/pull/14991
- https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8
- https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5
- https://github.com/advisories/GHSA-qwxx-xww6-8q8m
- https://nvd.nist.gov/vuln/detail/CVE-2023-49109