CVE-2025-62188 (GCVE-0-2025-62188)
Vulnerability from cvelistv5
Published
2026-04-09 09:27
Modified
2026-04-09 13:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.
This issue affects Apache DolphinScheduler versions 3.1.*.
Users are recommended to upgrade to:
* version ≥ 3.2.0 if using 3.1.x
As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:
```
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus
```
Alternatively, add the following configuration to the application.yaml file:
```
management:
endpoints:
web:
exposure:
include: health,metrics,prometheus
```
This issue has been reported as CVE-2023-48796:
https://cveprocess.apache.org/cve5/CVE-2023-48796
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache DolphinScheduler |
Version: 3.1.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-62188",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-09T13:57:14.827090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T13:57:33.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache DolphinScheduler",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "w aiyou"
},
{
"lang": "en",
"type": "reporter",
"value": "\u9b4f\u5927\u521b"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn \u003cstrong\u003eExposure of Sensitive Information to an Unauthorized Actor\u003c/strong\u003e vulnerability exists in Apache DolphinScheduler.\u003cbr\u003e\nThis vulnerability may allow unauthorized actors to access sensitive information, including database credentials.\u003c/p\u003e\n\u003cp\u003eThis issue affects \u003cstrong\u003eApache DolphinScheduler versions 3.1.*\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eUsers are recommended to upgrade to:\u003cbr\u003e\u003c/p\u003e\n\n\n\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eversion \u2265 3.2.0\u003c/strong\u003e if using \u003cstrong\u003e3.1.x\u003c/strong\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eAs a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:\u003c/p\u003e\n```\u003cbr\u003eMANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus\u003cbr\u003e```\u003cbr\u003e\n\u003cp\u003eAlternatively, add the following configuration to the \u003ccode\u003eapplication.yaml\u003c/code\u003e file:\u003c/p\u003e\n```\u003cbr\u003emanagement:\u003cbr\u003e\u0026nbsp; \u0026nbsp;endpoints:\u003cbr\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp;web:\u003cbr\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; exposure:\u003cbr\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; include: health,metrics,prometheus\u003cbr\u003e```\u003cbr\u003e\n\u003cp\u003eThis issue has been reported as \u003cstrong\u003eCVE-2023-48796\u003c/strong\u003e:\u003cbr\u003e\n\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://cveprocess.apache.org/cve5/CVE-2023-48796\"\u003ehttps://cveprocess.apache.org/cve5/CVE-2023-48796\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.\n\nThis vulnerability may allow unauthorized actors to access sensitive information, including database credentials.\n\n\nThis issue affects Apache DolphinScheduler versions 3.1.*.\n\n\nUsers are recommended to upgrade to:\n\n\n\n\n\n\n\n * version \u2265 3.2.0 if using 3.1.x\n\n\n\n\n\n\nAs a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:\n\n\n```\nMANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus\n```\n\nAlternatively, add the following configuration to the application.yaml file:\n\n\n```\nmanagement:\n\u00a0 \u00a0endpoints:\n\u00a0 \u00a0 \u00a0web:\n\u00a0 \u00a0 \u00a0 \u00a0 exposure:\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 include: health,metrics,prometheus\n```\n\nThis issue has been reported as CVE-2023-48796:\n\n https://cveprocess.apache.org/cve5/CVE-2023-48796"
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T09:27:13.570Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48796"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2025-62188",
"datePublished": "2026-04-09T09:27:13.570Z",
"dateReserved": "2025-10-08T15:40:33.512Z",
"dateUpdated": "2026-04-09T13:57:33.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-62188\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-09T13:57:14.827090Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-09T13:56:10.730Z\"}}], \"cna\": {\"title\": \"Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"w aiyou\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"\\u9b4f\\u5927\\u521b\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache DolphinScheduler\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.2.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2023-48796\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.\\n\\nThis vulnerability may allow unauthorized actors to access sensitive information, including database credentials.\\n\\n\\nThis issue affects Apache DolphinScheduler versions 3.1.*.\\n\\n\\nUsers are recommended to upgrade to:\\n\\n\\n\\n\\n\\n\\n\\n * version \\u2265 3.2.0 if using 3.1.x\\n\\n\\n\\n\\n\\n\\nAs a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:\\n\\n\\n```\\nMANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus\\n```\\n\\nAlternatively, add the following configuration to the application.yaml file:\\n\\n\\n```\\nmanagement:\\n\\u00a0 \\u00a0endpoints:\\n\\u00a0 \\u00a0 \\u00a0web:\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 exposure:\\n\\u00a0 \\u00a0 \\u00a0 \\u00a0 \\u00a0 include: health,metrics,prometheus\\n```\\n\\nThis issue has been reported as CVE-2023-48796:\\n\\n https://cveprocess.apache.org/cve5/CVE-2023-48796\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn \u003cstrong\u003eExposure of Sensitive Information to an Unauthorized Actor\u003c/strong\u003e vulnerability exists in Apache DolphinScheduler.\u003cbr\u003e\\nThis vulnerability may allow unauthorized actors to access sensitive information, including database credentials.\u003c/p\u003e\\n\u003cp\u003eThis issue affects \u003cstrong\u003eApache DolphinScheduler versions 3.1.*\u003c/strong\u003e.\u003c/p\u003e\\n\u003cp\u003eUsers are recommended to upgrade to:\u003cbr\u003e\u003c/p\u003e\\n\\n\\n\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cstrong\u003eversion \\u2265 3.2.0\u003c/strong\u003e if using \u003cstrong\u003e3.1.x\u003c/strong\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\\n\\n\u003cp\u003eAs a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:\u003c/p\u003e\\n```\u003cbr\u003eMANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus\u003cbr\u003e```\u003cbr\u003e\\n\u003cp\u003eAlternatively, add the following configuration to the \u003ccode\u003eapplication.yaml\u003c/code\u003e file:\u003c/p\u003e\\n```\u003cbr\u003emanagement:\u003cbr\u003e\u0026nbsp; \u0026nbsp;endpoints:\u003cbr\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp;web:\u003cbr\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; exposure:\u003cbr\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; include: health,metrics,prometheus\u003cbr\u003e```\u003cbr\u003e\\n\u003cp\u003eThis issue has been reported as \u003cstrong\u003eCVE-2023-48796\u003c/strong\u003e:\u003cbr\u003e\\n\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://cveprocess.apache.org/cve5/CVE-2023-48796\\\"\u003ehttps://cveprocess.apache.org/cve5/CVE-2023-48796\u003c/a\u003e\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-04-09T09:27:13.570Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-62188\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-09T13:57:33.406Z\", \"dateReserved\": \"2025-10-08T15:40:33.512Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-04-09T09:27:13.570Z\", \"assignerShortName\": \"apache\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…