title: Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
description: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability.  This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: Apache DolphinScheduler
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 3.0.1, status: affected, version: 3.0, versionType: custom
lessThanOrEqual: 3.1.0, status: affected, version: 3.1, versionType: custom
}
metrics:
other: [
content: {'text': 'low'}
type: Textual description of severity
]