Apache DolphinScheduler Security Vulnerability

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache USA Foundation. A security vulnerability exists in Apache DolphinScheduler prior to version 3.2.1. An attacker could exploit the vulnerability to obtain sensitive information...

CVE-2023-49068: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not...

GHSA-4VVC-R4P4-QGRR Apache DolphinScheduler sensitive information disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

Apache DolphinScheduler sensitive information disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

CVE-2023-48796

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

PYSEC-2023-268

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

PYSEC-2023-268

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.The information exposed to unauthorized actors may include sensitive data such as database credentials.Users who can't upgrade to the fixed version can also set environment variable...

CVE-2023-48796 Apache dolphinscheduler sensitive information disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

CVE-2023-48796

CVE-2023-48796 affects Apache DolphinScheduler (3.0.0–3.0.1). Root cause: exposure of sensitive information to unauthorized actors via the management endpoints web exposure, enabling leakage such as database credentials. Impact per sources: unauthorized access to sensitive data; high CVSS appears...

CVE-2023-48796 Apache dolphinscheduler sensitive information disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

CVE-2023-48796

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

CVE-2023-48796: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable...

Apache DolphinScheduler Information Disclosure Vulnerability

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache USA Foundation. An information disclosure vulnerability exists in Apache DolphinScheduler version 3.0.0 through versions prior to 3.0.2. An attacker could exploit the vulnerability to...

PT-2023-8697

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.2.1 Description The issue is related to the exposure of Remote Code Execution in Apache DolphinScheduler, which can be exploited by a remote attacker to execute arbitrary code. This could potentially...

Password Disclosure

dolphinscheduler-server is vulnerable to Password Disclosure. The vulnerability exists due to improper handling of logs in the process function of LoggerRequestProcessor.java, allowing an attacker to utilize tasks to read config files, which could include the database password...

Improper Authentication

org.apache.dolphinscheduler:dolphinscheduler-api is vulnerable to Improper Authentication. The vulnerability allows an attacker to bypass authentication mechanisms to gain access and perform unauthorized actions...

Apache DolphinScheduler Authorization Issues Vulnerability

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. Apache DolphinScheduler suffers from an authorization problem vulnerability that stems from the presence of incorrect authentication, which can ...

Apache DolphinScheduler's python gateway suffered from improper authentication

On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the...

GHSA-3JXW-CV35-2MMV Apache DolphinScheduler's python gateway suffered from improper authentication

On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the...