Description

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

Remediation

References

http://www.openwall.com/lists/oss-security/2023/11/30/4

https://github.com/apache/dolphinscheduler/pull/10307

https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj

Related Vulnerabilities

CVE-2022-41704 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge

CVE-2022-43420 Vulnerability in maven package org.jenkins-ci.plugins:contrast-continuous-application-security

CVE-2023-50164 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2019-10785 Vulnerability in maven package org.webjars.bowergithub.dojo:dojox

CVE-2019-10793 Vulnerability in maven package org.webjars.bower:dot-object

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Mailing List Third Party Advisory Issue Tracking Patch Vendor Advisory NVD-CWE-noinfo