CVE-2023-49299

CVE-2023-49299: Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Vendor Apache Software Foundation

Product Apache DolphinScheduler

Weakness CWE-20 · Input validation

Published December 30, 2023

Last update February 13, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.

Key dates

Disclosure timeline

December 30, 2023 CVE published

February 13, 2025 Record updated