CVE-2024-23320

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.

• CWE-20

• http://www.openwall.com/lists/oss-security/2024/02/23/3Mailing List, Third Party Advisory
• https://github.com/apache/dolphinscheduler/pull/15487Issue Tracking, Patch
• https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqqVendor Advisory
• https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cpVendor Advisory
• https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmVendor Advisory
• http://www.openwall.com/lists/oss-security/2024/02/23/3Mailing List, Third Party Advisory
• https://github.com/apache/dolphinscheduler/pull/15487Issue Tracking, Patch
• https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqqVendor Advisory
• https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cpVendor Advisory
• https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokmVendor Advisory

Published

Feb 23, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23314When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK syste…7.5
• CVE-2024-23315A read-what-where vulnerability exists in the Programming So…7.5
• CVE-2024-23316HTTP request desynchronization in Ping Identity PingAccess, …8.8
• CVE-2024-23317External Control of File Name or Path (CWE-73) in the Contro…6.3
• CVE-2024-23319Mattermost Jira Plugin fails to protect against logout CSRF …3.5
• CVE-2024-2332A vulnerability was found in SourceCodester Online Mobile Ma…7.2
• CVE-2024-23321For RocketMQ versions 5.2.0 and below, under certain conditi…8.8
• CVE-2024-23322Envoy is a high-performance edge/middle/service proxy. Envoy…7.5
• CVE-2024-23323Envoy is a high-performance edge/middle/service proxy. The r…5.3
• CVE-2024-23324Envoy is a high-performance edge/middle/service proxy. Exter…7.5
• CVE-2024-23325Envoy is a high-performance edge/middle/service proxy. Envoy…7.5
• CVE-2024-23326Envoy is a cloud-native, open source edge and service proxy.…8.2