Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jNmNnLTczcDMtOTczaM4AA3Xa

Apache DolphinScheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.

Permalink: https://github.com/advisories/GHSA-c6cg-73p3-973h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNmNnLTczcDMtOTczaM4AA3Xa
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago


EPSS Percentage: 0.00106
EPSS Percentile: 0.44719

Identifiers: GHSA-c6cg-73p3-973h, CVE-2023-49068
References: Repository: https://github.com/apache/dolphinscheduler
Blast Radius: 0.0

Affected Packages

maven:org.apache.dolphinscheduler:dolphinscheduler-api
Dependent packages: 5
Dependent repositories: 82
Downloads:
Affected Version Ranges: < 3.2.1
Fixed in: 3.2.1
All affected versions: 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.9, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0
All unaffected versions: 3.2.1