PYSEC-2023-268
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/apache-dolphinscheduler/PYSEC-2023-268.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2023-268
- Aliases
- Published
- 2023-11-24T08:15:00Z
- Modified
- 2024-11-21T14:56:59.501507Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
The information exposed to unauthorized actors may include sensitive data such as database credentials.
Users who can't upgrade to the fixed version can also set environment variable
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheusto workaround this, or add the following section in theapplication.yamlfilemanagement: endpoints: web: exposure: include: health,metrics,prometheusThis issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
- References
Affected packages
PyPI / apache-dolphinscheduler
Package
- Name
- apache-dolphinscheduler
- View open source insights on deps.dev
- Purl
- pkg:pypi/apache-dolphinscheduler