What is GHSA-2fm6-mv57-p2qh?

GHSA-2fm6-mv57-p2qh is a security advisory published by GitHub Security Advisories with Critical severity. Apache Dolphinscheduler Code Injection vulnerability

Which CVE IDs does GHSA-2fm6-mv57-p2qh cover?

GHSA-2fm6-mv57-p2qh covers the following CVE IDs: CVE-2024-43202. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2fm6-mv57-p2qh?

GHSA-2fm6-mv57-p2qh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-2fm6-mv57-p2qh?

GHSA-2fm6-mv57-p2qh affects 1 product, including: maven/org.apache.dolphinscheduler:dolphinscheduler-task-api:\u003e= 3.1.0, \u003c 3.2.2.

GHSA-2fm6-mv57-p2qhCriticalCVSS 9.8

Apache Dolphinscheduler Code Injection vulnerability

Vendor

GitHub Security Advisories

Published

August 20, 2024

Last Modified

August 31, 2026

🔗 CVE IDs covered (1)

CVE-2024-43202 →

📋 Description

Exposure of Remote Code Execution in Apache Dolphinscheduler.

This issue affects Apache DolphinScheduler: before 3.2.2.

We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.

🎯 Affected products1

maven/org.apache.dolphinscheduler:dolphinscheduler-task-api:>= 3.1.0, < 3.2.2

🔗 References (9)

https://nvd.nist.gov/vuln/detail/CVE-2024-43202
https://github.com/apache/dolphinscheduler/pull/15758
https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5
https://lists.apache.org/thread/qbhk9wqyxhrn4z7m4m343wqxpwg926nh
https://www.cve.org/CVERecord?id=CVE-2023-49109
https://github.com/apache/dolphinscheduler/commit/dc306bfa1d3ed72eb7b72b177e33a46042d2a9c3
http://www.openwall.com/lists/oss-security/2024/08/20/2
https://github.com/apache/dolphinscheduler/commit/c7789bf0499f5893810d93e144250544a528caa4
https://github.com/advisories/GHSA-2fm6-mv57-p2qh