Riskcovery

CVE-2022-45875

Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin

State
Published
Severity
9.8 Critical
Published
Jan 4, 2023
Updated
Apr 3, 2025
Reserved
Nov 24, 2022

Read the record on cve.org

Description

Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Apache DolphinSchedulerApache Software Foundation
  • 3.0 through 3.0.1Affected
  • 3.1 through 3.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.