CVE-2024-30188 Apache DolphinScheduler: Resource File Read And Write Vulnerability

What is CVE-2024-30188?

CVE-2024-30188 is a high-severity vulnerability in Apache DolphinScheduler, published on 9 Aug 2024.

Official description

File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.

Users are recommended to upgrade to version 3.2.2, which fixes the issue.

Weakness: CWE-20

Which versions are affected by CVE-2024-30188?

2 open source packages ship an affected version, including org.apache.dolphinscheduler:dolphinscheduler. It affects 1 product.

Products include Apache Dolphinscheduler.

How do I fix CVE-2024-30188?

Upgrade org.apache.dolphinscheduler:dolphinscheduler to 3.2.2 or later.

Is CVE-2024-30188 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-30188 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Apache DolphinScheduler

• CVE-2024-43166 Apache DolphinScheduler Incorrect Default Permissions Vulnerability Critical 9.8
• CVE-2024-43202 Apache DolphinScheduler: Remote Code Execution Vulnerability Critical 9.8
• CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler Critical 9.8
• CVE-2022-45875 Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin Critical 9.8
• CVE-2022-45462 Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4vv4-crw4-8pcw.