PT-2023-31274 · Unknown · Dolphinscheduler

Yuanheng Lab · Published 2023-11-30 · Updated 2023-12-05 · CVE-2023-49620

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DolphinScheduler versions prior to 3.1.0

Description The issue allows authenticated users to delete UDF functions in the resource center without authorization, which is related to an unauthorized access vulnerability, also known as Insecure Direct Object Reference (IDOR). This vulnerability requires user login to operate.

Recommendations For versions prior to 3.1.0, upgrade to version 3.1.0 to avoid this issue. As a temporary workaround, consider restricting access to the resource center and UDF functions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-49620

GHSA-R44Q-98GX-PMH2

Affected Products

Dolphinscheduler

References · 11

• https://github.com/apache/dolphinscheduler/pull/10307 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49620 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49620 · Vendor Advisory
• https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r44q-98gx-pmh2 · Vendor Advisory
• https://github.com/apache/dolphinscheduler · Note
• https://github.com/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530ac · Note
• https://t.me/cvenotify/61616 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/30/4 · Note
• https://t.me/cvenotify/61626 · Telegram Post
• https://twitter.com/oss_security/status/1730326801912606935 · Twitter Post