GHSA-4vv4-crw4-8pcw

Apache DolphinScheduler: Resource File Read And Write Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-30188

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.dolphinscheduler:dolphinscheduler	>= 3.1.0, < 3.2.2	3.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-30188 advisory
https://github.com/apache/dolphinscheduler package
https://lists.apache.org/thread/tbrt42mnr42bq6scxwt6bjr3s2pwyd07 web