CVE-2023-49620

Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

EPSS 1.1%CWE-862

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

30 nov 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

Produtos afetados

Apache Software Foundation · Apache DolphinScheduler

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/apache/dolphinscheduler/pull/10307 https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj http://www.openwall.com/lists/oss-security/2023/11/30/4