← voltar
CVE-2023-48796

Apache dolphinscheduler sensitive information disclosure

EPSS 1.2%CWE-200
Vexday Risk Score
3Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS EPSS 1.2%KEV nãoPoC Nuclei Metasploit Patch referenciado
Ciclo de vida
24 nov 2023Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →