CVE-2023-49299

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.

• CWE-20
• CWE-20

• http://www.openwall.com/lists/oss-security/2024/02/23/3
• https://github.com/apache/dolphinscheduler/pull/15228Patch, Vendor Advisory
• https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/02/23/3
• https://github.com/apache/dolphinscheduler/pull/15228Patch, Vendor Advisory
• https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmMailing List, Vendor Advisory

Published

Dec 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49293Vite is a website frontend framework. When Vite's HTML trans…6.1
• CVE-2023-49294Asterisk is an open source private branch exchange and telep…7.5
• CVE-2023-49295quic-go is an implementation of the QUIC protocol (RFC 9000,…6.5
• CVE-2023-49296The Arduino Create Agent allows users to use the Arduino Cre…6.1
• CVE-2023-49297PyDrive2 is a wrapper library of google-api-python-client th…7.8
• CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain s…7.5
• CVE-2023-4930The Front End PM WordPress plugin before 11.4.3 does not blo…6.5
• CVE-2023-4931Uncontrolled search path element vulnerability in Plesk Inst…7.8
• CVE-2023-49312Precision Bridge PrecisionBridge.exe (aka the thick client) …9.1
• CVE-2023-49313A dylib injection vulnerability in XMachOViewer 0.04 allows …9.8
• CVE-2023-49314Asana Desktop 2.1.0 on macOS allows code injection because o…7.8
• CVE-2023-49316In Math/BinaryField.php in phpseclib 3 before 3.0.34, excess…7.5