GHSA-4vvc-r4p4-qgrr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4vvc-r4p4-qgrr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-4vvc-r4p4-qgrr/GHSA-4vvc-r4p4-qgrr.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4vvc-r4p4-qgrr
- Aliases
- Published
- 2023-11-24T09:30:28Z
- Modified
- 2024-11-21T21:34:36.599093Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Apache DolphinScheduler sensitive information disclosure
- Details
-
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
The information exposed to unauthorized actors may include sensitive data such as database credentials.
Users who can't upgrade to the fixed version can also set environment variable
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheusto workaround this, or add the following section in theapplication.yamlfilemanagement: endpoints: web: exposure: include: health,metrics,prometheusThis issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
- Database specific
{ "nvd_published_at": "2023-11-24T08:15:20Z", "cwe_ids": [ "CWE-200" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-11-27T23:27:35Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-48796
- https://github.com/apache/dolphinscheduler
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2023-268.yaml
- https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo
- http://www.openwall.com/lists/oss-security/2023/11/24/1
Affected packages
Maven / org.apache.dolphinscheduler:dolphinscheduler
Package
- Name
- org.apache.dolphinscheduler:dolphinscheduler
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.dolphinscheduler/dolphinscheduler
PyPI / apache-dolphinscheduler
Package
- Name
- apache-dolphinscheduler
- View open source insights on deps.dev
- Purl
- pkg:pypi/apache-dolphinscheduler