Not rated
CVE-2023-49250 Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM)…
Description
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache DolphinScheduler 3.2 | earliest → 3.2.0 | No fix stated |
| dolphinscheduler | 3.2.0 | No fix stated |
| dolphinscheduler | 3.1.9 | No fix stated |
| dolphinscheduler | 3.0.6 | No fix stated |
| dolphinscheduler | 2.0.9 | No fix stated |
| dolphinscheduler | 1.3.9 | No fix stated |
| dolphinscheduler | 1.2.1 | No fix stated |
| dolphinscheduler | 1.1.0 | No fix stated |
| dolphinscheduler | 1.0.5 | No fix stated |
References
- github.com github.com
- lists.apache.org lists.apache.org
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache DolphinScheduler
The 46 CVEs of Apache DolphinScheduler →
CVE-2026-71896
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account…
Not rated
CVE-2026-71895
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes…
Not rated
CVE-2026-71183
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data…
Not rated
CVE-2026-66087
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance…
Not rated