High severity · published Nov 27, 2023
CVE-2023-49068
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolphinscheduler · Apache
before 3.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49068
Issue Tracking
https://github.com/apache/dolphinscheduler/pull/15192
Mailing List
https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
More from Dolphinscheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.8
CVE-2024-43166
Incorrect Default Permissions vulnerability in Apache DolphinScheduler
9.8
CVE-2024-43202
Exposure of Remote Code Execution in Apache Dolphinscheduler
9.8
CVE-2023-49109
Exposure of Remote Code Execution in Apache Dolphinscheduler
9.8
CVE-2022-45875
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability