org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.3), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.3) +1 more potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.3)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.3 -...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.4), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.4) +1 more potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.4)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.4 -...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (1.3.9) potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics =1.1....

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.5), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.5) +1 more potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.5)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.5 -...

org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.0.6)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.0.0-alpha, =3.0.6 Source cves: CVE-2023-49068 Source advisory: GHSA-C6CG-73P3-973H...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.9), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.9) +1 more potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.9 -...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.6), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.6) +1 more potentially affected by CVE-2023-49068 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.6)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.6 -...

CVE-2023-49068 Apache DolphinScheduler: Information Leakage Vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not...

CVE-2023-49068

CVE-2023-49068 affects Apache DolphinScheduler (before 3.2.1). The issue is exposure of sensitive information to an unauthorized actor via logs, with risk of leaking session-related data. Root cause is that log statements in the DolphinScheduler codebase may retain sensitive fields (e.g., session...