org.apache.dolphinscheduler:dolphinscheduler (Maven)
Advisories
18
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.4.1 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.dolphinscheduler</groupId><artifactId>dolphinscheduler</artifactId><version>3.4.1</version></dependency>gradle
implementation("org.apache.dolphinscheduler:dolphinscheduler:3.4.1")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-72mv-wwvm-vgp5 Apache DolphinScheduler has an Incorrect Authorization Vulnerability |
High EPSS 0.45% |
< 3.4.1 | 3.4.1 |
| GHSA-f786-9c63-8xr8 Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability |
Medium EPSS 0.54% |
>= 3.2.0, < 3.3.1 | 3.3.1 |
| GHSA-3cjc-vhfm-ffp2 Apache DolphinScheduler vulnerable to sensitive information disclosure |
High EPSS 0.52% |
>= 3.1.0, < 3.2.0 | 3.2.0 |
| GHSA-rrpj-r8h7-rm7r Apache DolphinScheduler Incorrect Default Permissions Vulnerability |
Critical EPSS 0.53% |
< 3.3.1 | 3.3.1 |
| GHSA-3vcp-r62v-xpvg Apache DolphinScheduler vulnerable to Alert Script Attack |
High EPSS 0.59% |
< 3.2.2 | 3.2.2 |
| GHSA-4vv4-crw4-8pcw Apache DolphinScheduler: Resource File Read And Write Vulnerability |
High EPSS 5.99% |
>= 3.1.0, < 3.2.2 | 3.2.2 |
| GHSA-m9q4-p56m-mc6q Apache DolphinScheduler: RCE by arbitrary js execution |
High EPSS 1.18% |
< 3.2.2 | 3.2.2 |
| GHSA-ff2w-wm48-jhqj Arbitrary File Read Vulnerability in Apache Dolphinscheduler |
High EPSS 1.24% |
< 3.2.1 | 3.2.1 |
| GHSA-vjqc-g788-f378 Session Fixation Apache DolphinScheduler |
Medium EPSS 1.31% |
>= 1.3.8, < 3.2.1 | 3.2.1 |
| GHSA-37gx-jqx9-fwmg Improper Certificate Validation in Apache DolphinScheduler |
High EPSS 0.70% |
< 3.2.1 | 3.2.1 |
| GHSA-qwxx-xww6-8q8m Remote Code Execution in Apache Dolphinscheduler |
Critical EPSS 2.30% |
>= 3.0.0, < 3.2.1 | 3.2.1 |
| GHSA-4vvc-r4p4-qgrr Apache DolphinScheduler sensitive information disclosure |
High EPSS 1.19% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-3xh5-8hvq-rc8x Apache DolphinScheduler vulnerable to Improper Input Validation |
Critical EPSS 2.66% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-3xh5-8hvq-rc8x Apache DolphinScheduler vulnerable to Improper Input Validation |
Critical EPSS 2.66% |
< 3.0.2 | 3.0.2 |
| GHSA-fp35-xrrr-3gph Apache DolphinScheduler vulnerable to Path Traversal |
Medium EPSS 1.73% |
< 3.0.0 | 3.0.0 |
| GHSA-vpgf-fgm8-gxr2 Apache DolphinScheduler vulnerable to Path Traversal |
Medium EPSS 1.82% |
< 2.0.6 | 2.0.6 |
| GHSA-qg5x-66hp-cw5p Uncontrolled Resource Consumption in Apache DolphinScheduler |
High EPSS 1.98% |
< 2.0.5 | 2.0.5 |
| GHSA-jpj4-5xwp-cv23 Remote code execution in DolphinScheduler |
Critical EPSS 8.12% |
< 1.3.0 | 1.3.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor