Package · Maven

org.apache.dolphinscheduler:dolphinscheduler-common

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Medium 6.5

CVE-2023-49620

Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve a…

Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-api org.apache.dolphinscheduler:dolphinscheduler-common Maven

Nov 30, 2023
High 7.5

CVE-2022-26885

Apache DolphinScheduler config file read by task risk

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.

Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-common Maven

Nov 24, 2022