CVE-2023-49620 json
Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
published 2023-11-30 2 y ago modified 2026-06-17 4 mo ago also GHSA-r44q-98gx-pmh2 , EUVD-2023-3021
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Patch / fix
- maven org.apache.dolphinscheduler:dolphinscheduler-api 3.1.0
- maven org.apache.dolphinscheduler:dolphinscheduler-common 3.1.0
- maven org.apache.dolphinscheduler:dolphinscheduler-dao 3.1.0
- maven org.apache.dolphinscheduler:dolphinscheduler-service 3.1.0
- Apache Software Foundation Apache DolphinScheduler 3.1.0
- github.com/apache/dolphinscheduler@a4948f5 commit
- github.com/apache/dolphinscheduler#10307 pull request
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.dolphinscheduler:dolphinscheduler-api | <3.1.0 |
3.1.0 |
| maven | org.apache.dolphinscheduler:dolphinscheduler-common | <3.1.0 |
3.1.0 |
| maven | org.apache.dolphinscheduler:dolphinscheduler-dao | <3.1.0 |
3.1.0 |
| maven | org.apache.dolphinscheduler:dolphinscheduler-service | <3.1.0 |
3.1.0 |
Affected products
- Apache Software Foundation Apache DolphinScheduler
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/apache/dolphinscheduler/pull/10307
patch, web, issue-tracking
-
github.com
/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530ac
web
-
lists.apache.org
/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2023/11/30/4
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49620
advisory
-
github.com
/apache/dolphinscheduler
package
Sources
- CVE List CVE-2023-49620
- GitHub Advisory GHSA-r44q-98gx-pmh2
- NVD CVE-2023-49620
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.