Skip to main content

Improper Input Validation

CVE-2024-23320

High
8.7/10

Summary

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This vulnerability affects org.apache.dolphinscheduler:dolphinscheduler-master package versions 3.0.0-alpha through 3.2.0, and org.apache.dolphinscheduler:dolphinscheduler-server package 2.0.0-alpha versions through 2.0.9.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published