CVE-2024-23320

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23320
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/02/23/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/02/23/3 Mailing List Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15487 Issue Tracking Patch
https://github.com/apache/dolphinscheduler/pull/15487 Issue Tracking Patch
https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq Vendor Advisory
https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq Vendor Advisory
https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp Vendor Advisory
https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp Vendor Advisory
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm Vendor Advisory
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
History

18 Mar 2025, 17:54

Type Values Removed Values Added
CPE cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Apache dolphinscheduler
Apache
References () https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp - () https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp - Vendor Advisory
References () https://github.com/apache/dolphinscheduler/pull/15487 - () https://github.com/apache/dolphinscheduler/pull/15487 - Issue Tracking, Patch
References () https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm - () https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm - Vendor Advisory
References () https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq - () https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/02/23/3 - () http://www.openwall.com/lists/oss-security/2024/02/23/3 - Mailing List, Third Party Advisory

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
CWE CWE-20

23 Feb 2024, 19:31

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/02/23/3 -

23 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-23 17:15

Updated : 2025-03-18 17:54

NVD link : CVE-2024-23320

Mitre link : CVE-2024-23320

JSON object : View

Products Affected

apache

  • dolphinscheduler
CWE
NVD-CWE-noinfo