CVE-2023-49299

—

CVSS 3.1

8.8 high

EPSS

1%p71

Published

Dec 30, 2023 (Dec 30, 2023)

Modified

Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.

Vendors: apache
Products: dolphinscheduler
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.