CVE-2022-45875
Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
CVE-2022-45875 is a critical vulnerability (CVSS 9.8) in Apache Dolphinscheduler, published January 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in org.apache.dolphinscheduler:dolphinscheduler 3.0.2.
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
- Record
CVE-2022-45875- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List
Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
- Record
CVE-2022-45875- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-0036
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
- Record
EUVD-2023-0036- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3xh5-8hvq-rc8x
Apache DolphinScheduler vulnerable to Improper Input Validation
Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.
- Record
GHSA-3xh5-8hvq-rc8x- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
- Record
CVE-2022-45875- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-3xh5-8hvq-rc8x
Apache DolphinScheduler vulnerable to Improper Input Validation
Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.
- Record
GHSA-3xh5-8hvq-rc8x- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2023-4 No score
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
- Record
PYSEC-2023-4- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.dolphinscheduler:dolphinschedulerMaven |
before 3.0.2 | 3.0.2 |
org.apache.dolphinscheduler:dolphinschedulerMaven |
3.1.0 to 3.1.0 | 3.1.1 |
org.apache.dolphinscheduler:dolphinschedulerMaven |
before 3.0.2, plus listed versions 1.2.01.2.11.3.01.3.11.3.2 Show 23 moreShow less1.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.0-alpha2.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.93.0.03.0.0-alpha3.0.0-beta-13.0.0-beta-23.0.1 |
3.0.2 |
org.apache.dolphinscheduler:dolphinschedulerMaven |
3.1.0 up to 3.1.1 | 3.1.1 |
apache-dolphinschedulerPyPI |
before 3.0.2, plus listed versions 0.1.00.1.12.0.52.0.5.12.0.7 Show 5 moreShow less3.0.03.0.0a03.0.0b13.0.0b23.0.1 |
3.0.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r
openwall.com/lists/oss-security/2023/11/22/2
nvd.nist.gov/vuln/detail/CVE-2022-45875
github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2023-4.yaml