Main Vulnerability Database SB2024022821

SB2024022821 - Remote code execution in Apache DolphinScheduler

Published: February 28, 2024

Security Bulletin ID SB2024022821

Severity

Medium

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2024-23320)

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to an incomplete fix for #VU84881 (CVE-2023-49299). A remote user can pass specially crafted input to the application and execute arbitrary JavaScript code on the server.

Remediation

Install update from vendor's website.

References

https://lists.apache.org/thread/rn6nfy2q7ycj7l798pyl68nmzhr87z0s