GHSA-3vcp-r62v-xpvg

Apache DolphinScheduler vulnerable to Alert Script Attack

Source: GitHub Advisory Database (reviewed) High CVE-2024-43115

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.dolphinscheduler:dolphinscheduler	< 3.2.2	3.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-43115 advisory
https://github.com/apache/dolphinscheduler package
https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj web
http://www.openwall.com/lists/oss-security/2025/09/03/1 web