CVE-2024-29831

Published: Aug 12, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

Affected (1)

Products: Apache: Dolphinscheduler

Apache

1 product

Dolphinscheduler

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Dolphinscheduler	Before 3.2.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2024/08/09/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.