CVE-2024-29831

Apache DolphinScheduler: RCE by arbitrary js execution

CVSS 8.8 HIGHEPSS 1.2%CWE-20

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.8EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

09 ago 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Apache Software Foundation · Apache DolphinScheduler

Referências

https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0 http://www.openwall.com/lists/oss-security/2024/08/09/6