Advisories · Technology
Apache Software Foundation Apache DolphinScheduler.
Every CVE that names Apache Software Foundation Apache DolphinScheduler among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 7.1 High
Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 7.1 High
Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 8.1 High
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 8.1 High
Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 6.5 Medium
Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 4.3 Medium
Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 4.3 Medium
Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 6.5 Medium
Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 5.3 Medium
Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 4.3 Medium
Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 8.8 High
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
- Apache Software Foundation Apache DolphinScheduler
- Command injection
- CVSS 6.5 Medium
Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
- Apache Software Foundation Apache DolphinScheduler
- Authentication bypass
- CVSS 8.1 High
Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 8.8 High
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
- Apache Software Foundation Apache DolphinScheduler
- Broken access control