org.apache.dolphinscheduler:dolphinscheduler

4 results · Clear filters · Feed

• Medium 6.3
  CVE-2025-62233

  Apache DolphinScheduler: Deserialization of untrusted data in RPC

  Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler:  Version >= 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a Stand…

  Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler org.apache.dolphinscheduler:dolphinscheduler-rpc Maven
  Apr 24, 2026
• Medium 6.5
  CVE-2023-50270

  Apache DolphinScheduler: Session do not expire after password change

  Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

  Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler Maven
  Feb 20, 2024
• Medium 6.5
  CVE-2022-34662 Public exploit

  Apache DolphinScheduler prior to 3.0.0 allows path traversal

  When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher

  Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler Maven
  Nov 1, 2022
• Medium 6.5
  CVE-2022-26884 Public exploit

  Apache DolphinScheduler exposes files without authentication

  Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

  Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler Maven
  Oct 28, 2022