CVE-2023-49299

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.

Users are recommended to upgrade to version 3.1.9, which fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	< 3.1.9
apache	dolphinscheduler	< 3.1.9

References

http://www.openwall.com/lists/oss-security/2024/02/23/3
https://github.com/apache/dolphinscheduler/pull/15228Patch, Vendor Advisory
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/23/3
https://github.com/apache/dolphinscheduler/pull/15228Patch, Vendor Advisory
https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmMailing List, Vendor Advisory

Timeline

Published: Dec 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-49306.5The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to privat CVE-2023-49317.8Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by CVE-2023-493129.1Precision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity violation in which the same license key is use CVE-2023-493139.8A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be CVE-2023-493147.8Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection CVE-2023-493167.5In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.CVE-2023-49325.4SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SA CVE-2023-493215.3Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. Thi CVE-2023-493227.5Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. Thi CVE-2023-493287.2On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve CVE-2023-493297.2Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This a CVE-2023-49335.3The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job