CVE-2023-49250

2024-02-2010:15:08

CWE-295

[email protected]

web.nvd.nist.gov

2394

apache dolphinscheduler

cve-2023-49250

http

certificate verification

vulnerability

upgrade

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.1%

JSON

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.0.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.

References

www.openwall.com/lists/oss-security/2024/02/20/1

github.com/apache/dolphinscheduler/pull/15288

lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn