org.apache.dolphinscheduler:dolphinscheduler-common 3.0.0-alpha vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.dolphinscheduler:dolphinscheduler-common package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
C Improper Control of Generation of Code ('Code Injection') Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the task execution interface. An attacker can execute arbitrary code on the server by sending a crafted request. How to fix Improper Control of Generation of Code ('Code Injection')? A fix was pushed into the `master` branch but not yet published.	[0,)
H Improper Certificate Validation Affected versions of this package are vulnerable to Improper Certificate Validation due to the `HttpUtils` class not verifying certificates. An attacker capable of performing a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. How to fix Improper Certificate Validation? Upgrade `org.apache.dolphinscheduler:dolphinscheduler-common` to version 3.2.1 or higher.	[,3.2.1)
M Missing Authorization Affected versions of this package are vulnerable to Missing Authorization allowing an authenticated user to delete UDFs in the resource center without proper permissions. How to fix Missing Authorization? Upgrade `org.apache.dolphinscheduler:dolphinscheduler-common` to version 3.1.0 or higher.	[2.0.0,3.1.0)
M Directory Traversal Affected versions of this package are vulnerable to Directory Traversal due to improper resource validation. Exploiting this vulnerability allows users to add resources to the resource center with a relation path, which will impact only logged-in users. How to fix Directory Traversal? Upgrade `org.apache.dolphinscheduler:dolphinscheduler-common` to version 2.6.0, 3.0.0 or higher.	[,2.6.0)[3.0.0-alpha,3.0.0)

Vulnerability

Vulnerable Version

Improper Control of Generation of Code ('Code Injection')

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the task execution interface. An attacker can execute arbitrary code on the server by sending a crafted request.

How to fix Improper Control of Generation of Code ('Code Injection')?

A fix was pushed into the master branch but not yet published.

[0,)

Improper Certificate Validation

Affected versions of this package are vulnerable to Improper Certificate Validation due to the HttpUtils class not verifying certificates. An attacker capable of performing a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

How to fix Improper Certificate Validation?

Upgrade org.apache.dolphinscheduler:dolphinscheduler-common to version 3.2.1 or higher.

[,3.2.1)

Missing Authorization

Affected versions of this package are vulnerable to Missing Authorization allowing an authenticated user to delete UDFs in the resource center without proper permissions.

How to fix Missing Authorization?

Upgrade org.apache.dolphinscheduler:dolphinscheduler-common to version 3.1.0 or higher.

[2.0.0,3.1.0)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal due to improper resource validation. Exploiting this vulnerability allows users to add resources to the resource center with a relation path, which will impact only logged-in users.

How to fix Directory Traversal?

Upgrade org.apache.dolphinscheduler:dolphinscheduler-common to version 2.6.0, 3.0.0 or higher.

[,2.6.0)[3.0.0-alpha,3.0.0)

org.apache.dolphinscheduler:dolphinscheduler-common@3.0.0-alpha vulnerabilities

latest version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?