High severity · published Aug 9, 2024
CVE-2024-29831
Apache DolphinScheduler: RCE by arbitrary js execution
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
through 3.2.1 · source: vendor, CISA
DO
Dolphinscheduler · Apache
before 3.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29831
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29831
Vendor Advisory
https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
Mailing List
http://www.openwall.com/lists/oss-security/2024/08/09/6
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.8
CVE-2024-43166
Incorrect Default Permissions vulnerability in Apache DolphinScheduler
9.8
CVE-2024-43202
Apache DolphinScheduler: Remote Code Execution Vulnerability
9.8
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks