Platform
java
Component
org.apache.dolphinscheduler:dolphinscheduler-task-api
Fixed in
3.2.2
3.2.2
CVE-2024-43202 describes a critical Remote Code Execution (RCE) vulnerability discovered in Apache Dolphinscheduler. This flaw allows an attacker to potentially execute arbitrary code on a vulnerable system. The vulnerability impacts versions of Apache Dolphinscheduler up to and including 3.2.1. A patch is available in version 3.2.2.
The RCE vulnerability in Apache Dolphinscheduler poses a significant threat. An attacker could exploit this flaw to gain complete control over the server hosting the Dolphinscheduler instance. This could lead to data breaches, system compromise, and further lateral movement within the network. The attacker could potentially steal sensitive data, modify configurations, or even use the compromised server as a launchpad for attacks against other systems. The potential blast radius is substantial, particularly in environments where Dolphinscheduler is used to orchestrate critical workflows.
CVE-2024-43202 was publicly disclosed on August 20, 2024. While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity and ease of exploitation suggest a high probability of exploitation. The vulnerability is not currently listed on CISA KEV. Public proof-of-concept exploits are likely to emerge given the nature of the vulnerability.
Exploit Status
EPSS
4.41% (89% percentile)
CVSS Vector
The primary mitigation for CVE-2024-43202 is to immediately upgrade Apache Dolphinscheduler to version 3.2.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the Dolphinscheduler API. Review and harden the Dolphinscheduler configuration, paying close attention to authentication and authorization settings. Monitor system logs for any suspicious activity related to Dolphinscheduler. After upgrading, confirm the fix by attempting to trigger the vulnerable API endpoint and verifying that it no longer executes arbitrary code.
Update Apache DolphinScheduler to version 3.2.2 or higher. This version contains the fix for the Remote Code Execution vulnerability. The update will mitigate the risk of exploitation.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-43202 is a critical Remote Code Execution vulnerability affecting Apache Dolphinscheduler versions 3.2.1 and earlier, allowing attackers to execute arbitrary code.
Yes, if you are running Apache Dolphinscheduler versions 3.2.1 or earlier, you are vulnerable to this RCE.
Upgrade Apache Dolphinscheduler to version 3.2.2 or later to remediate the vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity suggests a high probability of exploitation.
Refer to the Apache Dolphinscheduler project website and security announcements for the official advisory: https://dolphinscheduler.apache.org/
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.