CVE-2022-45875

EPSS 3.72%
Published 04.01.2023 15:15:09
Last modified 03.04.2025 16:15:28
Source security@apache.org
Teams watchlist Login
Open Login

Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability.  This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Dolphinscheduler Version < 3.0.2

Apache ≫ Dolphinscheduler Version3.1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	3.72%	0.875

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.openwall.com/lists/oss-security/2023/11/22/2

https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2022-45875

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-45875

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-45875

EUVD