Medium severity6.5NVD Advisory· Published Nov 30, 2023· Updated Jun 17, 2026
CVE-2023-49620
CVE-2023-49620
Description
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.dolphinscheduler:dolphinscheduler-apiMaven | < 3.1.0 | 3.1.0 |
org.apache.dolphinscheduler:dolphinscheduler-commonMaven | < 3.1.0 | 3.1.0 |
org.apache.dolphinscheduler:dolphinscheduler-daoMaven | < 3.1.0 | 3.1.0 |
org.apache.dolphinscheduler:dolphinscheduler-serviceMaven | < 3.1.0 | 3.1.0 |
Affected products
6cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*range: <3.1.0
- (no CPE)range: 2.0.0
- ghsa-coords4 versionspkg:maven/org.apache.dolphinscheduler/dolphinscheduler-apipkg:maven/org.apache.dolphinscheduler/dolphinscheduler-commonpkg:maven/org.apache.dolphinscheduler/dolphinscheduler-daopkg:maven/org.apache.dolphinscheduler/dolphinscheduler-service
< 3.1.0+ 3 more
- (no CPE)range: < 3.1.0
- (no CPE)range: < 3.1.0
- (no CPE)range: < 3.1.0
- (no CPE)range: < 3.1.0
Patches
Vulnerability mechanics
References
6- github.com/apache/dolphinscheduler/pull/10307nvdIssue TrackingPatchWEB
- www.openwall.com/lists/oss-security/2023/11/30/4nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-r44q-98gx-pmh2ghsaADVISORY
- lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yjnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-49620ghsaADVISORY
- github.com/apache/dolphinscheduler/commit/a4948f58e671ab263060da1de255af3ecd2530acghsaWEB
News mentions
0No linked articles in our index yet.