CVE-2023-49068— Apache DolphinScheduler: Information Leakage Vulnerability
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-49068
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache DolphinScheduler: Information Leakage Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Apache DolphinScheduler 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache DolphinScheduler是美国阿帕奇（Apache）基金会的一个分布式的基于DAG可视化的工作流任务调度系统。 Apache DolphinScheduler 3.2.1 版本之前存在安全漏洞。攻击者利用该漏洞可以获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache DolphinScheduler | 0 ~ 3.2.1 | - |
II. Public POCs for CVE-2023-49068
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-49068
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-49068 (1)
- https://github.com/apache/dolphinscheduler/pull/15192issue-tracking
Mailing List Discussions for CVE-2023-49068 (1)
Same Patch Batch · Apache Software Foundation · 2023-11-27 · 5 CVEs total
| CVE-2023-49145 | 7.9 HIGH | Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt |
| CVE-2023-40610 | 6.3 MEDIUM | Apache Superset: Privilege escalation with default examples database |
| CVE-2023-43701 | 4.3 MEDIUM | Apache Superset: Stored XSS on API endpoint |
| CVE-2023-42501 | 4.3 MEDIUM | Apache Superset: Unnecessary read permissions within the Gamma role |
IV. Related Vulnerabilities
Same product: Apache DolphinScheduler
- CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerab - CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface la - CVE-2026-42357
Apache DolphinScheduler: Incorrect Authorization vulnerabili - CVE-2026-41280
Apache DolphinScheduler: Incorrect Authorization vulnerabili - CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorizatio
Same vendor: Apache Software Foundation
- CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v - CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
Same weakness: CWE-200
- CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti - CVE-2026-71424
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for - CVE-2026-57485
Stirling-PDF: Internal Service Account API Key Disclosure vi - CVE-2026-68520
Glances: as_dict_secure() Value-Level Bypass Leaks Credentia - CVE-2026-64859
New API: User List API Leaks Root User Access Token Leading
V. Comments for CVE-2023-49068
No comments yet