« Volver al listado

CVE-2023-49250

Estado: AnalizadaAlta (7.3)—

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.0.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Dolphinscheduler

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-49250",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-49250",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-14T15:17:49.511453Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache DolphinScheduler",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "3.2.0"
            }
          ],
          "packageName": "org.apache.dolphinscheduler:dolphinscheduler-common",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:apache:dolphinscheduler:1.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:1.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:1.3.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:2.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:3.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:3.1.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:apache:dolphinscheduler:3.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "apache",
          "product": "dolphinscheduler",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.5"
            },
            {
              "status": "affected",
              "version": "1.1.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            },
            {
              "status": "affected",
              "version": "1.3.9"
            },
            {
              "status": "affected",
              "version": "2.0.9"
            },
            {
              "status": "affected",
              "version": "3.0.6"
            },
            {
              "status": "affected",
              "version": "3.1.9"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-02-20T10:15:08.040",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/02/20/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://github.com/apache/dolphinscheduler/pull/15288",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/02/20/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/apache/dolphinscheduler/pull/15288",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.\n\nThis issue affects Apache DolphinScheduler: before 3.2.0.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Debido a que la clase HttpUtils no verificó los certificados, un atacante que pudiera realizar un ataque Man-in-the-Middle (MITM) en conexiones https salientes podría hacerse pasar por el servidor. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.0. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona el problema."
    }
  ],
  "lastModified": "2026-06-17T06:35:41.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA8D19E0-BC4F-4F9C-A389-BB4D41183206",
              "versionEndExcluding": "3.2.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}