Apache DolphinScheduler Missing Authorization vulnerability

GHSA-r44q-98gx-pmh2 · CVE-2023-49620

Published Nov 30, 2023 · Modified Feb 16, 2024

Description

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

References

6.5 / 10

MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected Packages

Maven/org.apache.dolphinscheduler:dolphinscheduler-api

Fix 3.1.0

Introduced 0

31 affected versions

1.2.01.2.11.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.0-alpha2.0.12.0.22.0.32.0.42.0.52.0.6 +11 more

Maven/org.apache.dolphinscheduler:dolphinscheduler-common

Fix 3.1.0

Introduced 0

33 affected versions

1.2.01.2.11.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.0-alpha2.0.12.0.22.0.32.0.42.0.52.0.6 +13 more

Maven/org.apache.dolphinscheduler:dolphinscheduler-dao

Fix 3.1.0

Introduced 0

33 affected versions

1.2.01.2.11.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.0-alpha2.0.12.0.22.0.32.0.42.0.52.0.6 +13 more

Maven/org.apache.dolphinscheduler:dolphinscheduler-service

Fix 3.1.0

Introduced 0

29 affected versions

1.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.0-alpha2.0.12.0.22.0.32.0.42.0.52.0.62.0.93.0.0 +9 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes