title: Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability
description: Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
problem types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
vendor: Apache Software Foundation
product: Apache DolphinScheduler
versions:
version: unspecified, lessThanOrEqual: 2.0.5, status: affected, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'moderate'}
]