Command injection in Apache DolphinScheduler Alert Plugins

CRITICAL 9.8CVE-2022-45462 · GHSA-wqg7-mx6p-2rw3 · Published 23/11/2022 · updated 17/06/2026

In short

CVE-2022-45462 is a CRITICAL (CVSS 9.8) vulnerability affecting org.apache.dolphinscheduler:dolphinscheduler-alert-plugins, dolphinscheduler (apache).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 86.9% of all vulnerabilities.
Fix: update to 2.0.6 or later.

Package	Affected versions	Patched versions
org.apache.dolphinscheduler:dolphinscheduler-alert-plugins Maven	`< 2.0.6`	`2.0.6`
dolphinscheduler apache	`< 2.0.6`	`2.0.6`

Description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher.

NVD description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

References

nvd.nist.gov/vuln/detail/CVE-2022-45462 · ADVISORY
apache/dolphinscheduler#10744 · WEB
apache/dolphinscheduler#9834 · WEB
apache/dolphinscheduler · PACKAGE
lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w · WEB
openwall.com/lists/oss-security/2022/11/23/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free