Medium severity · published Nov 30, 2023
CVE-2023-49620
Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
2.0.0 before 3.1.0 · source: vendor
DO
Dolphinscheduler · Apache
before 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49620
Mailing List
http://www.openwall.com/lists/oss-security/2023/11/30/4
Issue Tracking
https://github.com/apache/dolphinscheduler/pull/10307
Mailing List
https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.8
CVE-2024-43166
Incorrect Default Permissions vulnerability in Apache DolphinScheduler
9.8
CVE-2024-43202
Apache DolphinScheduler: Remote Code Execution Vulnerability
9.8
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks