{"id":"CVE-2023-49109","aliases":["EUVD-2024-0705","GHSA-qwxx-xww6-8q8m"],"status":"published","title":"Remote Code Execution in Apache Dolphinscheduler","description":"Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.02301,"percentile":0.83538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2024-02-20T09:58:56Z","modified":"2026-10-28T02:30:42Z","exploits":[{"source":"pocgithub","id":"shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3-2-0","title":"shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3-2-0","date":"2025-08-19","url":"https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3-2-0"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.dolphinscheduler:dolphinscheduler","fixed_in":["3.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dolphinscheduler:dolphinscheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dolphinscheduler:dolphinscheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0"]}],"products":[{"vendor":"apache","product":"dolphinscheduler"},{"vendor":"apache software foundation","product":"apache dolphinscheduler"}],"references":[{"url":"https://github.com/apache/dolphinscheduler/pull/14991","tags":["patch","x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/20/4","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49109","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qwxx-xww6-8q8m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49109.json","tags":["advisory"]},{"url":"https://github.com/apache/dolphinscheduler","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-49109","title":"Remote Code Execution in Apache Dolphinscheduler","description":"Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.","status":"published","published":"2024-02-20T09:58:56.779Z","modified":"2025-02-13T17:18:34.198Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2024-0705","description":"Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.","status":"published","published":"2024-02-20T09:58:56Z","modified":"2025-02-13T17:18:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"ghsa":[{"id":"GHSA-qwxx-xww6-8q8m","title":"Remote Code Execution in Apache Dolphinscheduler","description":"This issue affects Apache DolphinScheduler 3.0.0 before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.  ","status":"published","published":"2024-02-20T12:30:58Z","modified":"2026-03-21T05:17:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2023-49109","description":"Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.","status":"published","published":"2024-02-20T10:15:07.927Z","modified":"2026-06-17T06:35:23.407Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"CVE-2023-49109","title":"Remote Code Execution in Apache Dolphinscheduler","description":"Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.","status":"published","published":"2024-02-20T09:58:56.779Z","modified":"2026-10-28T02:30:42.584192714Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"GHSA-qwxx-xww6-8q8m","title":"Remote Code Execution in Apache Dolphinscheduler","description":"This issue affects Apache DolphinScheduler 3.0.0 before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.  ","status":"published","published":"2024-02-20T12:30:58Z","modified":"2024-08-27T14:33:53.805475Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}