CVE-2023-49109

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Exposure of Remote Code Execution in Apache Dolphinscheduler.

This issue affects Apache DolphinScheduler: before 3.2.1.

We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	>= 3.0.0, < 3.2.1
apache	dolphinscheduler	>= 3.0.0, < 3.2.1

References

http://www.openwall.com/lists/oss-security/2024/02/20/4Mailing List, Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/14991Issue Tracking, Patch
https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8Vendor Advisory
https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/20/4Mailing List, Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/14991Issue Tracking, Patch
https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8Vendor Advisory
https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5Vendor Advisory

Timeline

Published: Feb 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-49117.8A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This CVE-2023-491107.2When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the CVE-2023-491116.5For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on t CVE-2023-491126.5Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the CVE-2023-491137.8The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can CVE-2023-491146.7A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arb CVE-2023-491157.5MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.CVE-2023-491175.4PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arb CVE-2023-491185.5in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.CVE-2023-491195.4Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an CVE-2023-49126.5An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16 CVE-2023-491217.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-b