Apache DolphinScheduler: RCE by arbitrary js execution

GHSA-m9q4-p56m-mc6q · CVE-2024-29831

Published Aug 12, 2024 · Modified Mar 19, 2025

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-29831
PACKAGE https://github.com/apache/dolphinscheduler
WEB https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
WEB http://www.openwall.com/lists/oss-security/2024/08/09/6

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes