Command injection in Apache DolphinScheduler Alert Plugins

CRITICO 9.8CVE-2022-45462 · GHSA-wqg7-mx6p-2rw3 · Published 23/11/2022 · updated 17/06/2026

In breve

CVE-2022-45462 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.apache.dolphinscheduler:dolphinscheduler-alert-plugins, dolphinscheduler (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.9%, superiore al 86.9% delle vulnerabilità.
Correzione: aggiornare a 2.0.6 o successiva.

Package	Affected versions	Patched versions
org.apache.dolphinscheduler:dolphinscheduler-alert-plugins Maven	`< 2.0.6`	`2.0.6`
dolphinscheduler apache	`< 2.0.6`	`2.0.6`

Description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher.

NVD description

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

References

nvd.nist.gov/vuln/detail/CVE-2022-45462 · ADVISORY
apache/dolphinscheduler#10744 · WEB
apache/dolphinscheduler#9834 · WEB
apache/dolphinscheduler · PACKAGE
lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w · WEB
openwall.com/lists/oss-security/2022/11/23/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free