Advisoriesby IbisdolphinschedulerGHSA-4vvc-r4p4-qgrr
Apache DolphinScheduler sensitive information disclosure
Fix: upgrade to 3.0.2 or later
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
The information exposed to unauthorized actors may include sensitive data such as database credentials.
Users who can't upgrade to the fixed version can also set environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus to workaround this, or add the following section in the application.yaml file
`
management:
endpoints:
web:
exposure:
include: health,metrics,prometheus
`
This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 3.0.0, < 3.0.2 | 3.0.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2023-48796, PYSEC-2023-268
- nvd.nist.gov/vuln/detail/CVE-2023-48796
- github.com/apache/dolphinscheduler
- github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2023-268.yaml
- lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo
- www.openwall.com/lists/oss-security/2023/11/24/1
- www.openwall.com/lists/oss-security/2025/11/28/1
More dolphinscheduler advisories
All dolphinscheduler
Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2Session Fixation Apache DolphinSchedulerCVE-2023-50270fixed in 3.2.1Arbitrary File Read Vulnerability in Apache DolphinschedulerCVE-2023-51770fixed in 3.2.1Improper Certificate Validation in Apache DolphinSchedulerCVE-2023-49250fixed in 3.2.1Remote Code Execution in Apache DolphinschedulerCVE-2023-49109fixed in 3.2.1