CVE-2023-48796
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
24/11/2023
Last modified:
13/02/2025
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.<br />
<br />
The information exposed to unauthorized actors may include sensitive data such as database credentials.<br />
<br />
Users who can&#39;t upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file<br />
<br />
```<br />
management:<br />
endpoints:<br />
web:<br />
exposure:<br />
include: health,metrics,prometheus<br />
```<br />
<br />
This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.<br />
<br />
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.0.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page