CVE-2023-49068: Apache DolphinScheduler: Information Leakage Vulnerability
First published: Fri Nov 24 2023(Updated: )
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.dolphinscheduler:dolphinscheduler-api | <3.2.1 | 3.2.1 |
| Apache DolphinScheduler | <3.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/dolphinscheduler/pull/15192
- https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
- https://nvd.nist.gov/vuln/detail/CVE-2023-49068
- https://github.com/apache/dolphinscheduler/commit/7308888c703fbe227887d2426273100582096134
- https://github.com/advisories/GHSA-c6cg-73p3-973h (Advisory)
Frequently Asked Questions
What is CVE-2023-49068?
CVE-2023-49068 is an Information Leakage Vulnerability in Apache DolphinScheduler.
How does CVE-2023-49068 affect Apache DolphinScheduler?
CVE-2023-49068 exposes sensitive information to an unauthorized actor in Apache DolphinScheduler.
Which version of Apache DolphinScheduler is affected by CVE-2023-49068?
Apache DolphinScheduler before version 3.2.1 is affected by CVE-2023-49068.
How can I fix CVE-2023-49068?
To fix CVE-2023-49068, users are recommended to upgrade to version 3.2.1 of Apache DolphinScheduler.
Where can I find more information about CVE-2023-49068?
More information about CVE-2023-49068 can be found at the following references: [link1](https://github.com/apache/dolphinscheduler/pull/15192), [link2](https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq), [link3](https://nvd.nist.gov/vuln/detail/CVE-2023-49068).
- collector/oss-sec
- alias/CVE-2023-49068
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-c6cg-73p3-973h
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory
- package-manager/maven
- vendor/apache
- canonical/apache dolphinscheduler