CVE-2023-49620
Assigner: apache
Published: 2023-11-30T08:17:01.765Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache DolphinScheduler
vendor: Apache Software Foundation
versions: lessThan: 3.1.0
status: affected
version: 2.0.0
versionType: semver
credits: type: finder
value: Yuanheng Lab of zhongfu
descriptions: supportingMedia: base64: no
type: text/html
value: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with&nbsp;unauthorized&nbsp;access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this&nbsp;vulnerability
value: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
metrics: other: content: text: moderate
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
source: discovery: UNKNOWN
title: Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
x_generator: engine: Vulnogram 0.1.0-dev