CVE-2023-49250

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.0.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	<= 3.2.0
apache	dolphinscheduler	1.0.5; 1.1.0; 1.2.1; 1.3.9; 2.0.9; 3.0.6; 3.1.9; 3.2.0

References

http://www.openwall.com/lists/oss-security/2024/02/20/1Mailing List, Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15288Issue Tracking, Patch
https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qnVendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/20/1Mailing List, Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15288Issue Tracking, Patch
https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qnVendor Advisory

Timeline

Published: Feb 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-492518.8A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected a CVE-2023-492527.5A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change withou CVE-2023-492539.8Root user password is hardcoded into the device and cannot be changed in the user interface.CVE-2023-492548.8Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the net CVE-2023-492559.8The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the confi CVE-2023-492567.5It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.CVE-2023-492578.8An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root u CVE-2023-492586.1User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located CVE-2023-492597.5The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a CVE-2023-49264.3The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or inco CVE-2023-492606.1An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path. It can be used together CVE-2023-492617.5The "tokenKey" value used in user authorization is visible in the HTML source of the login page.