CVE-2024-29831

moderate-risk
Published 2024-08-12

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

Do I need to act?

-
0.34% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (2)

Vendor Advisory https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
Mailing List http://www.openwall.com/lists/oss-security/2024/08/09/6
36
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal