CVE-2022-34662: Apache DolphinScheduler vulnerable to Path Traversal
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.33559%
CWE
Published
11/1/2022
Updated
1/31/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler | maven | < 3.0.0 | 3.0.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from improper path validation when handling user-supplied 'relation path' parameters. In Java-based systems, path traversal vulnerabilities typically occur in functions that: 1. Receive user input via API endpoints (Controller layer) 2. Process file paths in service methods (Service layer) without proper canonicalization. The ResourceService.createResource is a high-confidence candidate as resource management core logic would reside here, while the ResourceController.uploadResource is medium confidence as it's the entry point but might delegate validation to service layers. Both would fail to properly sanitize paths using methods like getCanonicalPath() with base directory checks.