CVE-2023-48796: Apache dolphinscheduler sensitive information disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
The information exposed to unauthorized actors may include sensitive data such as database credentials.
Users who can't upgrade to the fixed version can also set environment variable MANAGEMENTENDPOINTSWEBEXPOSUREINCLUDE=health,metrics,prometheus to workaround this, or add the following section in the application.yaml file
management: endpoints: web: exposure: include: health,metrics,prometheus
This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-48796.
What is the title of the vulnerability?
The title of the vulnerability is CVE-2023-48796: Apache dolphinscheduler sensitive information disclosure.
What is the description of the vulnerability?
The vulnerability involves the exposure of sensitive information to an unauthorized actor in Apache DolphinScheduler, potentially including database credentials.
What software is affected by this vulnerability?
The Apache DolphinScheduler version 3.0.0 up to and including version 3.0.2 is affected.
How can I fix CVE-2023-48796?
Users affected by this vulnerability should upgrade to version 3.0.2 of Apache DolphinScheduler or later. If upgrading is not possible, setting the environment variable MANAGEMENT_EN…