high7.5
CVE-2022-26885
Apache Dolphin Scheduler has insufficiently protected credentials
Impact
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.dolphinscheduler:dolphinscheduler-common | < 2.0.6 | 2.0.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Dolphinscheduler | before 2.0.6 |