CVE-2023-48796: Apache dolphinscheduler sensitive information disclosure
First published: Fri Nov 24 2023(Updated: )
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache DolphinScheduler | >=3.0.0<3.0.2 | |
| pip/apache-dolphinscheduler | >=3.0.0<3.0.2 | 3.0.2 |
| maven/org.apache.dolphinscheduler:dolphinscheduler | >=3.0.0<3.0.2 | 3.0.2 |
| >=3.0.0<3.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2023/11/24/1
- https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo
- https://nvd.nist.gov/vuln/detail/CVE-2023-48796
- https://github.com/advisories/GHSA-4vvc-r4p4-qgrr (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2023-268.yaml
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-48796.
What is the title of the vulnerability?
The title of the vulnerability is CVE-2023-48796: Apache dolphinscheduler sensitive information disclosure.
What is the description of the vulnerability?
The vulnerability involves the exposure of sensitive information to an unauthorized actor in Apache DolphinScheduler, potentially including database credentials.
What software is affected by this vulnerability?
The Apache DolphinScheduler version 3.0.0 up to and including version 3.0.2 is affected.
How can I fix CVE-2023-48796?
Users affected by this vulnerability should upgrade to version 3.0.2 of Apache DolphinScheduler or later. If upgrading is not possible, setting the environment variable MANAGEMENT_EN…
- collector/oss-sec
- alias/CVE-2023-48796
- collector/nvd-cve
- agent/author
- agent/type
- agent/first-publish-date
- agent/severity
- agent/title
- agent/weakness
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4vvc-r4p4-qgrr
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/apache
- canonical/apache dolphinscheduler
- version/apache dolphinscheduler/3.0.0
- package-manager/pip
- package-manager/maven