CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49068 – Apache DolphinScheduler: Information Leakage Vulnerability
https://notcve.org/view.php?id=CVE-2023-49068
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en Apache DolphinScheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. • https://github.com/apache/dolphinscheduler/pull/15192 https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48796 – Apache dolphinscheduler sensitive information disclosure
https://notcve.org/view.php?id=CVE-2023-48796
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en Apache DolphinScheduler. La información expuesta a actores no autorizados puede incluir datos confidenciales, como credenciales de bases de datos. Los usuarios que no pueden actualizar a la versión fija también pueden configurar la variable de entorno `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` para solucionar este problema, o agregar la siguiente sección en el archivo ``application.yaml` ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` Este problema afecta a Apache DolphinScheduler: desde 3.0.0 antes de 3.0.2. Se recomienda a los usuarios actualizar a la versión 3.0.2, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2023/11/24/1 https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25601 – Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication
https://notcve.org/view.php?id=CVE-2023-25601
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above. • http://www.openwall.com/lists/oss-security/2023/04/20/10 https://lists.apache.org/thread/25g77jqczp3t8cz56hk1p65q7m6c64rf • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-45875 – Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
https://notcve.org/view.php?id=CVE-2022-45875
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS. Validación incorrecta de los parámetros del complemento de alerta de script en Apache DolphinScheduler para evitar la vulnerabilidad de ejecución remota de comandos. Este problema afecta a Apache DolphinScheduler versión 3.0.1 y versiones anteriores; versión 3.1.0 y versiones anteriores. Este ataque solo lo pueden realizar usuarios autenticados que puedan iniciar sesión en DS. • http://www.openwall.com/lists/oss-security/2023/11/22/2 https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26885 – Apache DolphinScheduler config file read by task risk
https://notcve.org/view.php?id=CVE-2022-26885
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. Cuando se utilizan tareas para leer archivos de configuración, existe el riesgo de que se revele la contraseña de la base de datos. Le recomendamos actualizar a la versión 2.0.6 o superior. • https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp •