CVE-2024-43115

HIGH LAB

Apache DolphinScheduler <3.2.2 - RCE

Title source: llm

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Exploits (1)

github WORKING POC 1 stars
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2024-43115

References (2)

Scores

CVSS v3 8.8
EPSS 0.0009
EPSS Percentile 25.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Lab Environment

EIP LAB Lab screenshot
vulnerable docker pull ghcr.io/exploitintel/cve-2024-43115-vulnerable:latest
COMMUNITY
docker pull zookeeper:3.8
docker pull apache/dolphinscheduler-tools:3.2.1
docker pull apache/dolphinscheduler-api:3.2.1
docker pull apache/dolphinscheduler-alert-server:3.2.1

Details

CWE
CWE-20
Status published
Products (2)
apache/dolphinscheduler < 3.2.2
org.apache.dolphinscheduler/dolphinscheduler 0 - 3.2.2Maven
Published Sep 03, 2025
Tracked Since Feb 18, 2026