CVE-2023-49109

CRITICAL LAB

Apache DolphinScheduler <3.2.1 - RCE

Title source: llm

Description

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.

Exploits (2)

nomisec STUB
by shoucheng3 · poc
https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3-2-0

References (4)

Scores

CVSS v3 9.8
EPSS 0.0712
EPSS Percentile 91.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull eclipse-temurin:8-jre
docker pull bitnami/postgresql:15.2.0
docker pull bitnami/zookeeper:3.7.1
docker pull apache/dolphinscheduler-standalone-server:ci
docker pull yandex/clickhouse-server:21.12.3.32
+14 more images

Details

CWE
CWE-94
Status published
Products (2)
apache/dolphinscheduler 3.0.0 - 3.2.1
org.apache.dolphinscheduler/dolphinscheduler 3.0.0 - 3.2.1Maven
Published Feb 20, 2024
Tracked Since Feb 18, 2026