Auth bypass in Apache Dolphinscheduler
CVE-2023-49620
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Vulnerability class: Broken Access Control
EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Apache Dolphinscheduler
- Apache Software Foundation Dolphinscheduler — versions 2.0.0
Weakness classification (CWE)
References
- security@apache.org (Patch, patch, Issue Tracking)
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- security@apache.org (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-49620?
- CVE-2023-49620 is a medium-severity vulnerability in Apache Dolphinscheduler, classified under Missing Authorization. CVSS score: 6.5/10. Published 2023-11-30.
- How severe is CVE-2023-49620?
- Medium severity. CVSS v3 base score is 6.5 out of 10.