Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.

Affected Packages

Maven org.apache.dolphinscheduler:dolphinscheduler-api

Affected versions: 0 (fixed in 3.2.1)

Related CVEs

CVE-2023-49068

Key Information

GHSA ID

GHSA-c6cg-73p3-973h

Published

November 27, 2023 12:30 PM

Last Modified

November 28, 2023 8:51 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.apache.dolphinscheduler:dolphinscheduler-api

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 27, 2025 6:35 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.