Critical severity · published Jan 4, 2023
CVE-2022-45875
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability
9.8
CVSS
2.7%
EPSS
No
On KEV
Description
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolphinscheduler · Apache
before 3.0.2; 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45875
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45875
www.openwall.com
http://www.openwall.com/lists/oss-security/2023/11/22/2
Mailing List
https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r
More from Dolphinscheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.8
CVE-2024-43166
Incorrect Default Permissions vulnerability in Apache DolphinScheduler
9.8
CVE-2024-43202
Exposure of Remote Code Execution in Apache Dolphinscheduler
9.8
CVE-2023-49109
Exposure of Remote Code Execution in Apache Dolphinscheduler
9.8
CVE-2022-45462
Alarm instance management has command injection when there is a specific command configured