Information Exposure Affecting org.apache.dolphinscheduler:dolphinscheduler-master package, versions [3.0.0,3.0.2)
Threat Intelligence
EPSS
0.06% (25th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEDOLPHINSCHEDULER-6091932
- published 28 Nov 2023
- disclosed 24 Nov 2023
- credit Unknown
Introduced: 24 Nov 2023
CVE-2023-48796 Open this link in a new tabHow to fix?
Upgrade org.apache.dolphinscheduler:dolphinscheduler-master to version 3.0.2 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure due to the exposure of sensitive data to unauthorized actors. An attacker can access sensitive data such as database credentials by exploiting this vulnerability.
Workaround
This vulnerability can be mitigated by setting the environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus or adding the following section in the application.yaml file:
management:
endpoints:
web:
exposure:
include: health,metrics,prometheus
References
CVSS Scores
version 3.1