Apache Software Foundation Apache Dolphinscheduler vulnerabilities, page 3

46 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Dolphinscheduler, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2023-49109apache software foundationapache dolphinscheduler+2
EPSS score
2.30%
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.6.5CVE-2023-49620apache software foundationapache dolphinscheduler+5
EPSS score
1.13%
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability7.3CVE-2023-49250apache software foundationapache dolphinscheduler+2
EPSS score
0.70%
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue.8.8CVE-2023-49299apache software foundationapache dolphinscheduler+2
EPSS score
1.43%
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.7.5CVE-2023-49068apache software foundationapache dolphinscheduler+2
EPSS score
1.05%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.6.5CVE-2023-50270apache software foundationapache dolphinscheduler+2
EPSS score
1.31%
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.