What’s Vulnerable › Vulnerabilities

CVE-2023-49620: Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-30 · updated 2026-06-17
• Weakness: CWE-862

Description

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability

Affected products

• Apache Software Foundation Apache DolphinScheduler: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache DolphinScheduler 3.1.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/11/30/4
• https://github.com/apache/dolphinscheduler/pull/10307
• https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
• http://www.openwall.com/lists/oss-security/2023/11/30/4
• https://github.com/apache/dolphinscheduler/pull/10307
• https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj

Get alerted when CVE-2023-49620 or the next vulnerability affects your stack