Information disclosure in Apache Dolphinscheduler
CVE-2023-48796
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the f…
Vulnerability class: Information Disclosure
EPSS: 0.012 (64.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Dolphinscheduler
- Apache Software Foundation Dolphinscheduler — versions 3.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Mitigation, Vendor Advisory)
- security@apache.org (Mailing List, Third Party Advisory, Mitigation)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-48796?
- CVE-2023-48796 is a high-severity vulnerability in Apache Dolphinscheduler, classified under Information Disclosure. CVSS score: 7.5/10. Published 2023-11-24.
- How severe is CVE-2023-48796?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-48796 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.