{"basis":"claimed","id":"CVE-2024-29831","name":"Apache DolphinScheduler: RCE by arbitrary js execution","vendorProject":"Apache Software Foundation","product":"Apache DolphinScheduler","publishedAt":"2024-08-09","cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"exploited":null,"epss":{"score":0.01175,"percentile":0.67568,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-04-28","daysToRule":262},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Apache DolphinScheduler: RCE by arbitrary js execution","description":"Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.","cwes":["CWE-20"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-04-28","firstIsNew":true,"daysToRule":262,"daysAtMost":null,"freePlan":false,"claims":[{"id":"a7f9d2d1936d24c4917540b924fa54f8c9a43bb771718520956f944d70c7ca44","cve_id":"CVE-2024-29831","vendor":"f5","product":"Attack signatures","rule_id":"200204013","rule_name":"Apache DolphinScheduler Remote Code Execution","change":"new","default_action":null,"published_on":"2025-04-28","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204013 \"Apache DolphinScheduler Remote Code Execution\" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Apache. References: CVE-2024-29831.","first_seen_at":"2026-11-02T21:00:26.482Z"},{"id":"9654265e3acc6aa97aee739cff517b99c446a644b4b84c6e3387fefa5a42193b","cve_id":"CVE-2024-29831","vendor":"f5","product":"Attack signatures","rule_id":"200204013","rule_name":"Apache DolphinScheduler Remote Code Execution","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204013 \"Apache DolphinScheduler Remote Code Execution\" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Apache. References: CVE-2024-29831.","first_seen_at":"2026-11-02T21:00:26.263Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:17:16.726Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"measured":[],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}