CVE-2023-49299

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-49299

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49299.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-49299

Aliases

GHSA-v7hg-77v9-2445

Published

2023-12-30T16:27:12.045Z

Modified

2026-07-15T01:49:11.943859851Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Details

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.

Users are recommended to upgrade to version 3.1.9, which fixes the issue.

Database specific

{
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49299.json",
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Git / github.com/apache/dolphinscheduler

Affected ranges

Type

GIT

Repo

https://github.com/apache/dolphinscheduler

Events

Introduced

Fixed

400ed9147a3fd89c361e1c2bd53c94cb1e5c9b65

Database specific

{
    "cpe": "cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.9"
        }
    ]
}

Affected versions

1.*

1.1.0-preview

3.*

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49299.json"