CVE-2022-45462

CRITICAL9.8EPSS 21.3%

Command injection in Apache DolphinScheduler Alert Plugins

發布日:2022/11/23修改日:2023/11/8

描述

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher.

受影響套件(1)

Maven/org.apache.dolphinscheduler:dolphinscheduler-alert-pluginsfrom 0, < 2.0.6

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-45462
PATCHhttps://github.com/apache/dolphinscheduler
WEBhttps://github.com/apache/dolphinscheduler/pull/10744
WEBhttps://github.com/apache/dolphinscheduler/pull/9834
WEBhttps://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w
WEBhttp://www.openwall.com/lists/oss-security/2022/11/23/1