未評価
Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
CVE-2023-49620
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- patch github.com
- web openwall.com