CVE-2023-49068 json
Apache DolphinScheduler: Information Leakage Vulnerability
published 2023-11-27 2 y ago modified 2026-06-17 4 mo ago also GHSA-c6cg-73p3-973h , EUVD-2023-2948
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
Patch / fix
- maven org.apache.dolphinscheduler:dolphinscheduler-api 3.2.1
- Apache Software Foundation Apache DolphinScheduler 3.2.1
- github.com/apache/dolphinscheduler@7308888 commit
- github.com/apache/dolphinscheduler#15192 pull request
Exploit prediction
1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.dolphinscheduler:dolphinscheduler-api | <3.2.1 |
3.2.1 |
Affected products
- Apache Software Foundation Apache DolphinScheduler
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/apache/dolphinscheduler/pull/15192
issue-tracking, web, patch
-
github.com
/apache/dolphinscheduler/commit/7308888c703fbe227887d2426273100582096134
web
-
lists.apache.org
/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq
vendor-advisory, web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2023-49068
advisory
-
github.com
/apache/dolphinscheduler
package
Sources
- CVE List CVE-2023-49068
- GitHub Advisory GHSA-c6cg-73p3-973h
- NVD CVE-2023-49068
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.