Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.0.0-alpha
Typemaven
Namespaceorg.apache.dolphinscheduler
Namedolphinscheduler
Version3.0.0-alpha
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.4.1
Latest_non_vulnerable_version3.4.1
Affected_by_vulnerabilities
0
url VCID-6nzs-31fa-vudc
vulnerability_id VCID-6nzs-31fa-vudc
summary 
Missing Authorization
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-49620
reference_id
reference_type
scores
0
value 0.00333
scoring_system epss
scoring_elements 0.56416
published_at 2026-06-08T12:55:00Z
1
value 0.00333
scoring_system epss
scoring_elements 0.56432
published_at 2026-06-07T12:55:00Z
2
value 0.00333
scoring_system epss
scoring_elements 0.56444
published_at 2026-06-06T12:55:00Z
3
value 0.00333
scoring_system epss
scoring_elements 0.56438
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-49620
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530ac
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530ac
3
reference_url https://github.com/apache/dolphinscheduler/pull/10307
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler/pull/10307
4
reference_url https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
5
reference_url http://www.openwall.com/lists/oss-security/2023/11/30/4
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2023/11/30/4
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49620
reference_id CVE-2023-49620
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49620
7
reference_url https://github.com/advisories/GHSA-r44q-98gx-pmh2
reference_id GHSA-r44q-98gx-pmh2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r44q-98gx-pmh2
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.1.0
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1ra7-3xzm-jbgt
1
vulnerability VCID-9499-ush9-ayhh
2
vulnerability VCID-9nf3-ytdq-hfcu
3
vulnerability VCID-a9cw-q6g7-t3d6
4
vulnerability VCID-aer3-3j27-gqaa
5
vulnerability VCID-bqnz-n1hj-r3gx
6
vulnerability VCID-kw72-g6v7-7fgk
7
vulnerability VCID-m8pu-577g-4qe5
8
vulnerability VCID-p7d8-kg27-nbee
9
vulnerability VCID-pnp9-9m41-jqdh
10
vulnerability VCID-rkba-ka1m-fbdq
11
vulnerability VCID-t29h-zzxt-hbbk
12
vulnerability VCID-vcek-m7ex-a7hm
13
vulnerability VCID-zqv8-jxsz-pqgf
14
vulnerability VCID-zx11-jxkm-bycp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.1.0
aliases CVE-2023-49620, GHSA-r44q-98gx-pmh2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6nzs-31fa-vudc
1
url VCID-9499-ush9-ayhh
vulnerability_id VCID-9499-ush9-ayhh
summary 
Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server.

This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.

This issue affects Apache DolphinScheduler: until 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-23320
reference_id
reference_type
scores
0
value 0.00737
scoring_system epss
scoring_elements 0.73253
published_at 2026-06-06T12:55:00Z
1
value 0.00737
scoring_system epss
scoring_elements 0.73222
published_at 2026-06-08T12:55:00Z
2
value 0.00737
scoring_system epss
scoring_elements 0.73235
published_at 2026-06-07T12:55:00Z
3
value 0.00737
scoring_system epss
scoring_elements 0.73247
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-23320
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/commit/ef9ed3db55cb1647886b06c2b2c6a5cfcdccfb5c
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler/commit/ef9ed3db55cb1647886b06c2b2c6a5cfcdccfb5c
3
reference_url https://github.com/apache/dolphinscheduler/pull/15487
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-26T18:27:33Z/
url https://github.com/apache/dolphinscheduler/pull/15487
4
reference_url https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-26T18:27:33Z/
url https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq
5
reference_url https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-26T18:27:33Z/
url https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp
6
reference_url https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-26T18:27:33Z/
url https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
7
reference_url http://www.openwall.com/lists/oss-security/2024/02/23/3
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-26T18:27:33Z/
url http://www.openwall.com/lists/oss-security/2024/02/23/3
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-23320
reference_id CVE-2024-23320
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-23320
9
reference_url https://github.com/advisories/GHSA-rc6h-qwj9-2c53
reference_id GHSA-rc6h-qwj9-2c53
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rc6h-qwj9-2c53
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-kw72-g6v7-7fgk
2
vulnerability VCID-pnp9-9m41-jqdh
3
vulnerability VCID-rkba-ka1m-fbdq
4
vulnerability VCID-vcek-m7ex-a7hm
5
vulnerability VCID-zqv8-jxsz-pqgf
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
aliases CVE-2024-23320, GHSA-rc6h-qwj9-2c53
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9499-ush9-ayhh
2
url VCID-a9cw-q6g7-t3d6
vulnerability_id VCID-a9cw-q6g7-t3d6
summary 
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9.

Users are recommended to upgrade to version 3.1.9, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-49299
reference_id
reference_type
scores
0
value 0.00593
scoring_system epss
scoring_elements 0.69667
published_at 2026-06-08T12:55:00Z
1
value 0.00593
scoring_system epss
scoring_elements 0.69678
published_at 2026-06-07T12:55:00Z
2
value 0.00593
scoring_system epss
scoring_elements 0.69688
published_at 2026-06-06T12:55:00Z
3
value 0.00593
scoring_system epss
scoring_elements 0.6968
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-49299
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/commit/b5eddc0ce85d379080a51bf2162477f7d8c1b7d2
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler/commit/b5eddc0ce85d379080a51bf2162477f7d8c1b7d2
3
reference_url https://github.com/apache/dolphinscheduler/pull/15228
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-26T20:21:55Z/
url https://github.com/apache/dolphinscheduler/pull/15228
4
reference_url https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-26T20:21:55Z/
url https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm
5
reference_url http://www.openwall.com/lists/oss-security/2024/02/23/3
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-26T20:21:55Z/
url http://www.openwall.com/lists/oss-security/2024/02/23/3
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49299
reference_id CVE-2023-49299
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49299
7
reference_url https://github.com/advisories/GHSA-v7hg-77v9-2445
reference_id GHSA-v7hg-77v9-2445
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v7hg-77v9-2445
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.1.9
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.1.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9499-ush9-ayhh
1
vulnerability VCID-aer3-3j27-gqaa
2
vulnerability VCID-bqnz-n1hj-r3gx
3
vulnerability VCID-kw72-g6v7-7fgk
4
vulnerability VCID-m8pu-577g-4qe5
5
vulnerability VCID-p7d8-kg27-nbee
6
vulnerability VCID-pnp9-9m41-jqdh
7
vulnerability VCID-rkba-ka1m-fbdq
8
vulnerability VCID-t29h-zzxt-hbbk
9
vulnerability VCID-vcek-m7ex-a7hm
10
vulnerability VCID-zqv8-jxsz-pqgf
11
vulnerability VCID-zx11-jxkm-bycp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.1.9
aliases CVE-2023-49299, GHSA-v7hg-77v9-2445
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-a9cw-q6g7-t3d6
3
url VCID-aer3-3j27-gqaa
vulnerability_id VCID-aer3-3j27-gqaa
summary 
Insufficient Session Expiration
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-50270
reference_id
reference_type
scores
0
value 0.01042
scoring_system epss
scoring_elements 0.77805
published_at 2026-06-08T12:55:00Z
1
value 0.01042
scoring_system epss
scoring_elements 0.77818
published_at 2026-06-05T12:55:00Z
2
value 0.01042
scoring_system epss
scoring_elements 0.77825
published_at 2026-06-06T12:55:00Z
3
value 0.01042
scoring_system epss
scoring_elements 0.77815
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-50270
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/pull/15219
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:07:02Z/
url https://github.com/apache/dolphinscheduler/pull/15219
3
reference_url https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:07:02Z/
url https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
4
reference_url https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:07:02Z/
url https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
5
reference_url https://www.openwall.com/lists/oss-security/2024/02/20/3
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:07:02Z/
url https://www.openwall.com/lists/oss-security/2024/02/20/3
6
reference_url http://www.openwall.com/lists/oss-security/2024/02/20/3
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2024/02/20/3
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-50270
reference_id CVE-2023-50270
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-50270
8
reference_url https://github.com/advisories/GHSA-vjqc-g788-f378
reference_id GHSA-vjqc-g788-f378
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vjqc-g788-f378
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-kw72-g6v7-7fgk
2
vulnerability VCID-pnp9-9m41-jqdh
3
vulnerability VCID-rkba-ka1m-fbdq
4
vulnerability VCID-vcek-m7ex-a7hm
5
vulnerability VCID-zqv8-jxsz-pqgf
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
aliases CVE-2023-50270, GHSA-vjqc-g788-f378
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-aer3-3j27-gqaa
4
url VCID-bqnz-n1hj-r3gx
vulnerability_id VCID-bqnz-n1hj-r3gx
summary 
Improper Certificate Validation in Apache DolphinScheduler
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-49250
reference_id
reference_type
scores
0
value 0.0017
scoring_system epss
scoring_elements 0.38007
published_at 2026-06-07T12:55:00Z
1
value 0.0017
scoring_system epss
scoring_elements 0.37973
published_at 2026-06-08T12:55:00Z
2
value 0.0017
scoring_system epss
scoring_elements 0.38036
published_at 2026-06-05T12:55:00Z
3
value 0.0017
scoring_system epss
scoring_elements 0.38039
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-49250
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/pull/15288
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-14T15:17:49Z/
url https://github.com/apache/dolphinscheduler/pull/15288
3
reference_url https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-14T15:17:49Z/
url https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn
4
reference_url http://www.openwall.com/lists/oss-security/2024/02/20/1
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-14T15:17:49Z/
url http://www.openwall.com/lists/oss-security/2024/02/20/1
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49250
reference_id CVE-2023-49250
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49250
6
reference_url https://github.com/advisories/GHSA-37gx-jqx9-fwmg
reference_id GHSA-37gx-jqx9-fwmg
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-37gx-jqx9-fwmg
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-kw72-g6v7-7fgk
2
vulnerability VCID-pnp9-9m41-jqdh
3
vulnerability VCID-rkba-ka1m-fbdq
4
vulnerability VCID-vcek-m7ex-a7hm
5
vulnerability VCID-zqv8-jxsz-pqgf
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
aliases CVE-2023-49250, GHSA-37gx-jqx9-fwmg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bqnz-n1hj-r3gx
5
url VCID-kw72-g6v7-7fgk
vulnerability_id VCID-kw72-g6v7-7fgk
summary 
Apache DolphinScheduler vulnerable to Alert Script Attack
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.


This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-43115
reference_id
reference_type
scores
0
value 0.001
scoring_system epss
scoring_elements 0.27326
published_at 2026-06-05T12:55:00Z
1
value 0.001
scoring_system epss
scoring_elements 0.27187
published_at 2026-06-08T12:55:00Z
2
value 0.001
scoring_system epss
scoring_elements 0.27235
published_at 2026-06-07T12:55:00Z
3
value 0.001
scoring_system epss
scoring_elements 0.27275
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-43115
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-09-03T13:45:02Z/
url https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
3
reference_url http://www.openwall.com/lists/oss-security/2025/09/03/1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2025/09/03/1
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-43115
reference_id CVE-2024-43115
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-43115
5
reference_url https://github.com/advisories/GHSA-3vcp-r62v-xpvg
reference_id GHSA-3vcp-r62v-xpvg
reference_type
scores
url https://github.com/advisories/GHSA-3vcp-r62v-xpvg
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.2
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.2
1
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.0-alpha
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.0-alpha
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-rkba-ka1m-fbdq
2
vulnerability VCID-vcek-m7ex-a7hm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.0-alpha
aliases CVE-2024-43115, GHSA-3vcp-r62v-xpvg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kw72-g6v7-7fgk
6
url VCID-p7d8-kg27-nbee
vulnerability_id VCID-p7d8-kg27-nbee
summary 
Arbitrary File Read Vulnerability in Apache Dolphinscheduler.

This issue affects Apache DolphinScheduler: before 3.2.1.

We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-51770
reference_id
reference_type
scores
0
value 0.01343
scoring_system epss
scoring_elements 0.80391
published_at 2026-06-08T12:55:00Z
1
value 0.01343
scoring_system epss
scoring_elements 0.80399
published_at 2026-06-06T12:55:00Z
2
value 0.01343
scoring_system epss
scoring_elements 0.80396
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-51770
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/pull/15433
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/
url https://github.com/apache/dolphinscheduler/pull/15433
3
reference_url https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/
url https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
4
reference_url https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/
url https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
5
reference_url http://www.openwall.com/lists/oss-security/2024/02/20/2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/
url http://www.openwall.com/lists/oss-security/2024/02/20/2
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-51770
reference_id CVE-2023-51770
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-51770
7
reference_url https://github.com/advisories/GHSA-ff2w-wm48-jhqj
reference_id GHSA-ff2w-wm48-jhqj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ff2w-wm48-jhqj
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-kw72-g6v7-7fgk
2
vulnerability VCID-pnp9-9m41-jqdh
3
vulnerability VCID-rkba-ka1m-fbdq
4
vulnerability VCID-vcek-m7ex-a7hm
5
vulnerability VCID-zqv8-jxsz-pqgf
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
aliases CVE-2023-51770, GHSA-ff2w-wm48-jhqj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p7d8-kg27-nbee
7
url VCID-pnp9-9m41-jqdh
vulnerability_id VCID-pnp9-9m41-jqdh
summary 
Apache DolphinScheduler: RCE by arbitrary js execution
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-29831
reference_id
reference_type
scores
0
value 0.00339
scoring_system epss
scoring_elements 0.56924
published_at 2026-06-08T12:55:00Z
1
value 0.00339
scoring_system epss
scoring_elements 0.56939
published_at 2026-06-07T12:55:00Z
2
value 0.00339
scoring_system epss
scoring_elements 0.56951
published_at 2026-06-06T12:55:00Z
3
value 0.00339
scoring_system epss
scoring_elements 0.56943
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-29831
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-12T15:05:34Z/
url https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
3
reference_url http://www.openwall.com/lists/oss-security/2024/08/09/6
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2024/08/09/6
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-29831
reference_id CVE-2024-29831
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-29831
5
reference_url https://github.com/advisories/GHSA-m9q4-p56m-mc6q
reference_id GHSA-m9q4-p56m-mc6q
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m9q4-p56m-mc6q
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.2
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.2
1
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.0-alpha
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.0-alpha
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-rkba-ka1m-fbdq
2
vulnerability VCID-vcek-m7ex-a7hm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.0-alpha
aliases CVE-2024-29831, GHSA-m9q4-p56m-mc6q
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pnp9-9m41-jqdh
8
url VCID-rkba-ka1m-fbdq
vulnerability_id VCID-rkba-ka1m-fbdq
summary 
Apache DolphinScheduler has an Incorrect Authorization Vulnerability
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1. 

Users are recommended to upgrade to version 3.4.1, which fixes this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-23902
reference_id
reference_type
scores
0
value 0.00023
scoring_system epss
scoring_elements 0.06668
published_at 2026-06-05T12:55:00Z
1
value 0.00023
scoring_system epss
scoring_elements 0.0662
published_at 2026-06-08T12:55:00Z
2
value 0.00023
scoring_system epss
scoring_elements 0.06662
published_at 2026-06-07T12:55:00Z
3
value 0.00023
scoring_system epss
scoring_elements 0.06674
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-23902
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-24T18:25:12Z/
url https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-23902
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-23902
4
reference_url http://www.openwall.com/lists/oss-security/2026/04/24/1
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/24/1
5
reference_url https://github.com/advisories/GHSA-72mv-wwvm-vgp5
reference_id GHSA-72mv-wwvm-vgp5
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-72mv-wwvm-vgp5
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.4.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.4.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.4.1
aliases CVE-2026-23902, GHSA-72mv-wwvm-vgp5
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rkba-ka1m-fbdq
9
url VCID-t6hf-upum-fket
vulnerability_id VCID-t6hf-upum-fket
summary 
Apache DolphinScheduler vulnerable to Path Traversal
When users add resources to the resource center with a relation path, this vulnerability will cause path traversal issues for logged-in users. Users should upgrade to version 3.0.0 to avoid this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-34662
reference_id
reference_type
scores
0
value 0.01049
scoring_system epss
scoring_elements 0.7788
published_at 2026-06-08T12:55:00Z
1
value 0.01049
scoring_system epss
scoring_elements 0.77867
published_at 2026-06-04T12:55:00Z
2
value 0.01049
scoring_system epss
scoring_elements 0.77894
published_at 2026-06-05T12:55:00Z
3
value 0.01049
scoring_system epss
scoring_elements 0.77901
published_at 2026-06-06T12:55:00Z
4
value 0.01049
scoring_system epss
scoring_elements 0.77891
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-34662
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://lists.apache.org/thread/pbdzqf9ntxyvs4cr0x2dgk9zlf43btz8
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-06T03:16:38Z/
url https://lists.apache.org/thread/pbdzqf9ntxyvs4cr0x2dgk9zlf43btz8
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-34662
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-34662
4
reference_url http://www.openwall.com/lists/oss-security/2022/11/01/13
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-06T03:16:38Z/
url http://www.openwall.com/lists/oss-security/2022/11/01/13
5
reference_url https://github.com/advisories/GHSA-fp35-xrrr-3gph
reference_id GHSA-fp35-xrrr-3gph
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fp35-xrrr-3gph
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.0.0
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1ra7-3xzm-jbgt
1
vulnerability VCID-6nzs-31fa-vudc
2
vulnerability VCID-9499-ush9-ayhh
3
vulnerability VCID-a9cw-q6g7-t3d6
4
vulnerability VCID-aer3-3j27-gqaa
5
vulnerability VCID-bqnz-n1hj-r3gx
6
vulnerability VCID-bzfg-r7ht-f3bb
7
vulnerability VCID-kw72-g6v7-7fgk
8
vulnerability VCID-p7d8-kg27-nbee
9
vulnerability VCID-pnp9-9m41-jqdh
10
vulnerability VCID-rkba-ka1m-fbdq
11
vulnerability VCID-t29h-zzxt-hbbk
12
vulnerability VCID-vcek-m7ex-a7hm
13
vulnerability VCID-zx11-jxkm-bycp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.0.0
aliases CVE-2022-34662, GHSA-fp35-xrrr-3gph
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-t6hf-upum-fket
10
url VCID-vcek-m7ex-a7hm
vulnerability_id VCID-vcek-m7ex-a7hm
summary 
Apache DolphinScheduler Incorrect Default Permissions Vulnerability
Incorrect Default Permissions vulnerability in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-43166
reference_id
reference_type
scores
0
value 0.00162
scoring_system epss
scoring_elements 0.3687
published_at 2026-06-05T12:55:00Z
1
value 0.00162
scoring_system epss
scoring_elements 0.36876
published_at 2026-06-06T12:55:00Z
2
value 0.00162
scoring_system epss
scoring_elements 0.36841
published_at 2026-06-07T12:55:00Z
3
value 0.00162
scoring_system epss
scoring_elements 0.36803
published_at 2026-06-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-43166
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://lists.apache.org/thread/8zd69zkkx55qp365xp4tml1xh9og5lhk
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-09-03T13:44:48Z/
url https://lists.apache.org/thread/8zd69zkkx55qp365xp4tml1xh9og5lhk
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-43166
reference_id CVE-2024-43166
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-43166
4
reference_url https://github.com/advisories/GHSA-rrpj-r8h7-rm7r
reference_id GHSA-rrpj-r8h7-rm7r
reference_type
scores
url https://github.com/advisories/GHSA-rrpj-r8h7-rm7r
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-rkba-ka1m-fbdq
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.3.1
aliases CVE-2024-43166, GHSA-rrpj-r8h7-rm7r
risk_score 4.4
exploitability 0.5
weighted_severity 8.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vcek-m7ex-a7hm
11
url VCID-zx11-jxkm-bycp
vulnerability_id VCID-zx11-jxkm-bycp
summary 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-49068
reference_id
reference_type
scores
0
value 0.0016
scoring_system epss
scoring_elements 0.36615
published_at 2026-06-08T12:55:00Z
1
value 0.0016
scoring_system epss
scoring_elements 0.3668
published_at 2026-06-05T12:55:00Z
2
value 0.0016
scoring_system epss
scoring_elements 0.36688
published_at 2026-06-06T12:55:00Z
3
value 0.0016
scoring_system epss
scoring_elements 0.36652
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-49068
1
reference_url https://github.com/apache/dolphinscheduler
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler
2
reference_url https://github.com/apache/dolphinscheduler/commit/7308888c703fbe227887d2426273100582096134
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler/commit/7308888c703fbe227887d2426273100582096134
3
reference_url https://github.com/apache/dolphinscheduler/pull/15192
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/dolphinscheduler/pull/15192
4
reference_url https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49068
reference_id CVE-2023-49068
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49068
6
reference_url https://github.com/advisories/GHSA-c6cg-73p3-973h
reference_id GHSA-c6cg-73p3-973h
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c6cg-73p3-973h
fixed_packages
0
url pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
purl pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5p5x-ajpc-37fs
1
vulnerability VCID-kw72-g6v7-7fgk
2
vulnerability VCID-pnp9-9m41-jqdh
3
vulnerability VCID-rkba-ka1m-fbdq
4
vulnerability VCID-vcek-m7ex-a7hm
5
vulnerability VCID-zqv8-jxsz-pqgf
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.2.1
aliases CVE-2023-49068, GHSA-c6cg-73p3-973h
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zx11-jxkm-bycp
Fixing_vulnerabilities
Risk_score4.4
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dolphinscheduler/dolphinscheduler@3.0.0-alpha