CVE-2023-49620

Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

EPSS 1.1%CWE-862

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

30 Nov 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

Affected products

Apache Software Foundation · Apache DolphinScheduler

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/apache/dolphinscheduler/pull/10307 https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj http://www.openwall.com/lists/oss-security/2023/11/30/4