Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-30188: Apache DolphinScheduler lets logged-in users access extra files

CVE-2024-30188 · published 2 years ago

Summary

Users who can log into Apache DolphinScheduler could read or write files they should not reach. This could expose sensitive data or allow unwanted changes. Update the software to version 3.2.2 or later to close the gap.

What to do

Update apache org.apache.dolphinscheduler:dolphinscheduler to version 3.2.2.
Update apache dolphinscheduler to version 3.2.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	apache	org.apache.dolphinscheduler:dolphinscheduler	>= 3.1.0, < 3.2.2 Fix: upgrade to 3.2.2
–	apache	dolphinscheduler	>= 3.1.0, < 3.2.2 `cpe:2.3:a:apache:dolphinscheduler::::::::`

Original advisory text

Apache DolphinScheduler: Resource File Read And Write Vulnerability

File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files.
This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.

Users are recommended to upgrade to version 3.2.2, which fixes the issue.

References

http://www.openwall.com/lists/oss-security/2024/08/09/7 URL
https://github.com/advisories/GHSA-4vv4-crw4-8pcw
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30188... Vendor Advisory
https://lists.apache.org/thread/tbrt42mnr42bq6scxwt6bjr3s2pwyd07 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-30188 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

6% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published9 Aug 2024

Updated22 Oct 2026

First seen6 Mar 2026

Sources

GHSA-4vv4-crw4-8pcw · GHSA

CVE-2024-30188 · NVD

CVE-2024-30188 · OSV

Track software like this

Free during beta