Non évaluée
Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
CVE-2023-49620
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- patch github.com
- web openwall.com