Vulnerabilities > Apache > Dolphinscheduler

DATE CVE VULNERABILITY TITLE RISK
2024-08-12 CVE-2024-30188 Unspecified vulnerability in Apache Dolphinscheduler
File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.
network
low complexity
apache
8.1
2023-12-30 CVE-2023-49299 Unspecified vulnerability in Apache Dolphinscheduler
Improper Input Validation vulnerability in Apache DolphinScheduler.
network
low complexity
apache
8.8
2023-11-30 CVE-2023-49620 Unspecified vulnerability in Apache Dolphinscheduler
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue.
network
low complexity
apache
6.5
2023-11-27 CVE-2023-49068 Unspecified vulnerability in Apache Dolphinscheduler
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
network
low complexity
apache
7.5
2023-11-24 CVE-2023-48796 Unspecified vulnerability in Apache Dolphinscheduler 3.0.0/3.0.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
network
low complexity
apache
7.5
2023-04-20 CVE-2023-25601 Unspecified vulnerability in Apache Dolphinscheduler
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication.
network
low complexity
apache
4.3
2023-01-04 CVE-2022-45875 Unspecified vulnerability in Apache Dolphinscheduler
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability.
network
low complexity
apache
critical
9.8
2022-11-24 CVE-2022-26885 Unspecified vulnerability in Apache Dolphinscheduler
When using tasks to read config files, there is a risk of database password disclosure.
network
low complexity
apache
7.5
2022-11-23 CVE-2022-45462 Unspecified vulnerability in Apache Dolphinscheduler
Alarm instance management has command injection when there is a specific command configured.
network
low complexity
apache
critical
9.8
2022-11-01 CVE-2022-34662 Unspecified vulnerability in Apache Dolphinscheduler
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users.
network
low complexity
apache
6.5