PT-2023-31274 · Unknown · Dolphinscheduler

Yuanheng Lab · Publicado 2023-11-30 · Atualizado 2023-12-05 · CVE-2023-49620

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DolphinScheduler versions prior to 3.1.0

Description The issue allows authenticated users to delete UDF functions in the resource center without authorization, which is related to an unauthorized access vulnerability, also known as Insecure Direct Object Reference (IDOR). This vulnerability requires user login to operate.

Recommendations For versions prior to 3.1.0, upgrade to version 3.1.0 to avoid this issue. As a temporary workaround, consider restricting access to the resource center and UDF functions to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-49620

GHSA-R44Q-98GX-PMH2

Produtos afetados

Dolphinscheduler

Referências · 11

• https://github.com/apache/dolphinscheduler · Nota
• https://github.com/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530ac · Nota
• https://github.com/apache/dolphinscheduler/pull/10307 · Correção
• https://t.me/cvenotify/61616 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49620 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/11/30/4 · Nota
• https://t.me/cvenotify/61626 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49620 · Aviso do Fabricante
• https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r44q-98gx-pmh2 · Aviso do Fabricante
• https://twitter.com/oss_security/status/1730326801912606935 · Publicação no Twitter