CVE-2022-45875

Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/11/22/2
https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/11/22/2
https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:dolphinscheduler::::::::
	cpe:2.3:a:apache:dolphinscheduler:3.1.0:::::::*

History

21 Nov 2024, 07:29

Type	Values Removed	Values Added
Summary		(es) Validación incorrecta de los parámetros del complemento de alerta de script en Apache DolphinScheduler para evitar la vulnerabilidad de ejecución remota de comandos. Este problema afecta a Apache DolphinScheduler versión 3.0.1 y versiones anteriores; versión 3.1.0 y versiones anteriores. Este ataque solo lo pueden realizar usuarios autenticados que puedan iniciar sesión en DS.
References	~~() http://www.openwall.com/lists/oss-security/2023/11/22/2 -~~	() http://www.openwall.com/lists/oss-security/2023/11/22/2 -
References	~~() https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r - Mailing List, Vendor Advisory~~	() https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r - Mailing List, Vendor Advisory

22 Nov 2023, 09:15

Type	Values Removed	Values Added
Summary	Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.	Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
References		() http://www.openwall.com/lists/oss-security/2023/11/22/2 -

07 Nov 2023, 03:54

Type	Values Removed	Values Added
Summary	Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.	Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.

Information

Published : 2023-01-04 15:15

Updated : 2024-11-21 07:29

NVD link : CVE-2022-45875

Mitre link : CVE-2022-45875

CVE.ORG link : CVE-2022-45875

JSON object : View

Products Affected

apache

dolphinscheduler

CWE

CWE-20

Improper Input Validation

9.8 /10