TI-2023-10902 Aliases CVE-2023-25601 GHSA-3jxw-cv35-2mmv

Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication

LOW 22CWE-287Published 2023-04-20 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01127 66th percentileScored 2026-11-07

Fix Fixed Apache DolphinScheduler (Apache Software Foundation): 3.1.2org.apache.dolphinscheduler:dolphinscheduler-api (Maven): 3.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache DolphinScheduler	3.0.0 to before 3.1.2	3.1.2	Patch available	CNA
—	org.apache.dolphinscheduler:dolphinscheduler-api (Maven)	3.0.0 to before 3.1.2	3.1.2	Patch available	GHSA-3jxw-cv35-2mmv

Apache DolphinScheduler VendorApache Affected 3.0.0 to before 3.1.2 Fixed in 3.1.2 Patch available CNA
org.apache.dolphinscheduler:dolphinscheduler-api (Maven) Vendor— Affected 3.0.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-3jxw-cv35-2mmv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:dolphinscheduler::::::::	3.0.0 to before 3.1.2	Vulnerable	Apache

cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.1.2 Vulnerable ·Apache

Remediation

Fix · CNA Apache DolphinScheduler (Apache Software Foundation) Fixed in 3.1.2
Fix · GHSA-3jxw-cv35-2mmv org.apache.dolphinscheduler:dolphinscheduler-api (Maven) Fixed in 3.1.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-25601
2026-10-03 Alias added: GHSA-3jxw-cv35-2mmv

References

Advisory 2

Other 4

TI-2022-22673 Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin CVSS 3.1CRITICAL 9.8
TI-2022-22425 Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-28858 Apache DolphinScheduler: Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
TI-2023-26774 Remote Code Execution in Apache Dolphinscheduler CVSS 3.1CRITICAL 9.8
TI-2020-09634 Deserialization of untrusted data in Apache DolphinScheduler CVSS 3.1CRITICAL 9.8
TI-2024-28837 Incorrect default permissions in Apache DolphinScheduler CVSS 3.1CRITICAL 9.8

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences