PT-2023-20191 · Apache · Apache Dolphinscheduler

CVE-2023-25601

·

Published

2023-04-20

·

Updated

2023-05-01

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.0.0 through 3.1.1
Description The issue concerns improper authentication in Apache DolphinScheduler's python gateway, allowing an attacker to use a socket bytes attack without authentication. This has been fixed from version 3.1.2 onwards.
Recommendations For versions 3.0.0 through 3.1.1, turn off the python-gateway function by changing the value python-gateway.enabled=false in the configuration file application.yaml. Upgrade to version 3.1.2 or above if you are using the python gateway.

Exploit

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-25601
GHSA-3JXW-CV35-2MMV

Affected Products

Apache Dolphinscheduler