Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1jNmNnLTczcDMtOTczaM4AA3Xa
Apache DolphinScheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
Permalink: https://github.com/advisories/GHSA-c6cg-73p3-973hJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNmNnLTczcDMtOTczaM4AA3Xa
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 5 months ago
Identifiers: GHSA-c6cg-73p3-973h, CVE-2023-49068
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-49068
- https://github.com/apache/dolphinscheduler/pull/15192
- https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
- https://github.com/apache/dolphinscheduler/commit/7308888c703fbe227887d2426273100582096134
- https://github.com/advisories/GHSA-c6cg-73p3-973h
Blast Radius: 0.0
Affected Packages
maven:org.apache.dolphinscheduler:dolphinscheduler-api
Dependent packages: 5Dependent repositories: 82
Downloads:
Affected Version Ranges: < 3.2.1
Fixed in: 3.2.1
All affected versions: 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.9, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0
All unaffected versions: 3.2.1