What is GHSA-m9q4-p56m-mc6q?

GHSA-m9q4-p56m-mc6q is a security advisory published by GitHub Security Advisories with High severity. Apache DolphinScheduler: RCE by arbitrary js execution

Which CVE IDs does GHSA-m9q4-p56m-mc6q cover?

GHSA-m9q4-p56m-mc6q covers the following CVE IDs: CVE-2024-29831. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m9q4-p56m-mc6q?

GHSA-m9q4-p56m-mc6q has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-m9q4-p56m-mc6q?

GHSA-m9q4-p56m-mc6q affects 1 product, including: maven/org.apache.dolphinscheduler:dolphinscheduler:\u003c 3.2.2.

GHSA-m9q4-p56m-mc6qHighCVSS 8.8

Apache DolphinScheduler: RCE by arbitrary js execution

Vendor

GitHub Security Advisories

Published

August 12, 2024

Last Modified

March 19, 2025

🔗 CVE IDs covered (1)

CVE-2024-29831 →

📋 Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

🎯 Affected products1

maven/org.apache.dolphinscheduler:dolphinscheduler:< 3.2.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-29831
https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
http://www.openwall.com/lists/oss-security/2024/08/09/6
https://github.com/advisories/GHSA-m9q4-p56m-mc6q