CVE-2023-48796

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48796
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/11/24/1 Mailing List Mitigation Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/11/24/1 Mailing List Mitigation Third Party Advisory
https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo Mailing List Mitigation Vendor Advisory
https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo Mailing List Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
History

13 Feb 2025, 18:15

Type Values Removed Values Added
Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

01 Dec 2023, 20:14

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-200 NVD-CWE-noinfo
First Time Apache
Apache dolphinscheduler
References () http://www.openwall.com/lists/oss-security/2023/11/24/1 - () http://www.openwall.com/lists/oss-security/2023/11/24/1 - Mailing List, Mitigation, Third Party Advisory
References () https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo - () https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo - Mailing List, Mitigation, Vendor Advisory
CPE cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*

24 Nov 2023, 15:24

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2023/11/24/1 -

24 Nov 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-24 08:15

Updated : 2025-02-13 18:15

NVD link : CVE-2023-48796

Mitre link : CVE-2023-48796

JSON object : View

Products Affected

apache

  • dolphinscheduler
CWE
NVD-CWE-noinfo