Apache Dolphinscheduler
Monthly
Unsafe deserialization in Apache DolphinScheduler RPC module (versions 3.2.0 to 3.3.0) allows authenticated network attackers to achieve remote code execution by injecting malicious class types into StandardRpcRequest messages sent to Master or Worker nodes. The vulnerability requires network access and valid credentials but carries moderate CVSS (6.3) with very low EPSS exploitation probability (0.02%), suggesting limited real-world weaponization despite the dangerous vulnerability class.
Unauthenticated remote disclosure of database credentials and other sensitive configuration data in Apache DolphinScheduler 3.1.x via overly-permissive Spring Boot Actuator endpoints. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation without authentication. EPSS score of 0.02% (5th percentile) indicates low current exploitation likelihood despite the critical nature of credential exposure. Vendor patch available in version 3.2.0, with documented configuration-based workaround for organizations unable to upgrade immediately. No public exploit code identified and SSVC framework shows no active exploitation, though the vulnerability is automatable.
Unsafe deserialization in Apache DolphinScheduler RPC module (versions 3.2.0 to 3.3.0) allows authenticated network attackers to achieve remote code execution by injecting malicious class types into StandardRpcRequest messages sent to Master or Worker nodes. The vulnerability requires network access and valid credentials but carries moderate CVSS (6.3) with very low EPSS exploitation probability (0.02%), suggesting limited real-world weaponization despite the dangerous vulnerability class.
Unauthenticated remote disclosure of database credentials and other sensitive configuration data in Apache DolphinScheduler 3.1.x via overly-permissive Spring Boot Actuator endpoints. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation without authentication. EPSS score of 0.02% (5th percentile) indicates low current exploitation likelihood despite the critical nature of credential exposure. Vendor patch available in version 3.2.0, with documented configuration-based workaround for organizations unable to upgrade immediately. No public exploit code identified and SSVC framework shows no active exploitation, though the vulnerability is automatable.