CVE-2023-51770

HIGH LAB

Apache DolphinScheduler <3.2.1 - Info Disclosure

Title source: llm

Description

Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.

Exploits (2)

nomisec WORKING POC

by shoucheng3 · poc

https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

View Code ZIP pw:eip

nomisec WORKING POC

by shoucheng3 · poc

https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2023-51770_3-2-00

View Code ZIP pw:eip

References (4)

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2024/02/20/2

[Issue Tracking, Patch] https://github.com/apache/dolphinscheduler/pull/15433

[Mailing List, Vendor Advisory] https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g

[Mailing List, Vendor Advisory] https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw

Scores

CVSS v3 7.5

EPSS 0.0134

EPSS Percentile 80.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Lab Environment

COMMUNITY

Community Lab

docker pull eclipse-temurin:8-jre

docker pull bitnami/postgresql:15.2.0

docker pull bitnami/zookeeper:3.7.1

docker pull apache/dolphinscheduler-standalone-server:ci

docker pull yandex/clickhouse-server:21.12.3.32

+15 more images

https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2023-51770_3-2-00

https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

View in Library

Details

CWE

CWE-94

Status published

Products (2)

apache/dolphinscheduler 1.2.0 - 3.2.1

org.apache.dolphinscheduler/dolphinscheduler 0 - 3.2.1Maven

Published Feb 20, 2024

Tracked Since Feb 18, 2026