Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-kw72-g6v7-7fgk
Vulnerability ID VCID-kw72-g6v7-7fgk
Aliases CVE-2024-43115
GHSA-3vcp-r62v-xpvg
Summary Apache DolphinScheduler vulnerable to Alert Script Attack Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.001 https://api.first.org/data/v1/epss?cve=CVE-2024-43115
epss 0.001 https://api.first.org/data/v1/epss?cve=CVE-2024-43115
cvssv3.1 8.8 https://github.com/apache/dolphinscheduler
generic_textual HIGH https://github.com/apache/dolphinscheduler
cvssv3.1 8.8 https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
generic_textual HIGH https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
ssvc Track https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2024-43115
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-43115
cvssv3.1 8.8 http://www.openwall.com/lists/oss-security/2025/09/03/1
generic_textual HIGH http://www.openwall.com/lists/oss-security/2025/09/03/1
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-43115
https://github.com/apache/dolphinscheduler
https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
http://www.openwall.com/lists/oss-security/2025/09/03/1
CVE-2024-43115 https://nvd.nist.gov/vuln/detail/CVE-2024-43115
GHSA-3vcp-r62v-xpvg https://github.com/advisories/GHSA-3vcp-r62v-xpvg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/dolphinscheduler
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-09-03T13:45:02Z/ Found at https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-43115
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2025/09/03/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.27326
EPSS Score 0.001
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:25:02.552387+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.dolphinscheduler/dolphinscheduler/CVE-2024-43115.yml 38.6.0