Vulnerability · Published Nov 27, 2023 · Assigned by apache

CVE-2023-49068Apache DolphinScheduler: Information Leakage Vulnerability

High 7.5

In plain English

A high-severity information exposure in Apache DolphinScheduler from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.1%top 35.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.dolphinscheduler:dolphinscheduler-api	3.2.1	GHSA-c6cg-73p3-973h

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	0 – before 3.2.1

Weakness: CWE-200

References

https://github.com/apache/dolphinscheduler/pull/15192 issue-tracking
https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq vendor-advisory