CVE-2020-11974: Remote Code Execution in DolphinScheduler
Summary
CVE-2020-11974: Remote code execution in DolphinScheduler. Affects org.apache.dolphinscheduler:dolphinscheduler versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DolphinScheduler is an open-source distributed and easy-to-use visual workflow scheduling system. It is designed to solve the complex task scheduling problem in the big data environment. The package is widely used for managing and executing workflows in various industries. However, DolphinScheduler versions 1.2.0 and 1.2.1 are vulnerable to remote code execution when using mysql as the database, specifically when using the mysql connectorj library.
Vulnerability Detail
The vulnerability (CVE-2020-11974) allows an attacker to execute arbitrary code remotely. By exploiting this vulnerability, an attacker can gain unauthorized access to the system and potentially perform malicious activities. This vulnerability arises due to a flaw in the mysql connectorj library used by DolphinScheduler. The issue has a critical severity level with a CVSS score of 9.8. It was first published on February 9, 2022, and has been reviewed and confirmed by GitHub. The vulnerability is categorized under CWE-502.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading to a secure version of DolphinScheduler.
Conclusion
In conclusion, DolphinScheduler versions 1.2.0 and 1.2.1 are vulnerable to remote code execution when using mysql as the database. This critical vulnerability (CVE-2020-11974) allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access and malicious activities. To mitigate this vulnerability, it is crucial to upgrade DolphinScheduler to version 1.3.0 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.dolphinscheduler:dolphinscheduler →
FAQ
DolphinScheduler is an open-source distributed workflow scheduling system used for managing and executing workflows in big data environments.
The vulnerability allows remote code execution, enabling an attacker to execute arbitrary code on the affected system. This can lead to unauthorized access and potential malicious activities.
DolphinScheduler versions 1.2.0 and 1.2.1 are affected by this vulnerability.
This vulnerability has a critical severity level with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade DolphinScheduler to version 1.3.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dolphinscheduler:dolphinscheduler.
