Skip to content
OpenAdvisories
High · 7.5 CVE-2022-26885 EUVD-2022-7378GHSA-jvc3-wjf6-7c6c

Apache DolphinScheduler config file read by task risk

Published Nov 24, 2022 · Updated Apr 25, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler Package: org.apache.dolphinscheduler:dolphinscheduler-common Ecosystem: Maven

Description

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler Apache DolphinScheduler – < 2.0.6 2.0.6

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dolphinscheduler:dolphinscheduler-common < 2.0.6 2.0.6 GHSA-jvc3-wjf6-7c6c

References