GCVE - cpe:2.3:a:apache:dolphinscheduler:1.2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:dolphinscheduler:1.2.1:*:*:*:*:*:*:*

part: a version: 1.2.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Dolphinscheduler (`e50278c8-ec59-51a3-8889-26ed41328497`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/dolphinscheduler`	purl2cpe	2026-06-01 10:14:26.897096
`pkg:docker/apache/dolphinscheduler`	purl2cpe	2026-06-01 10:14:26.897097
`pkg:github/apache/dolphinscheduler`	purl2cpe	2026-06-01 10:14:26.897098
`pkg:maven/org.apache.dolphinscheduler/dolphinscheduler`	purl2cpe	2026-06-01 10:14:26.897100

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-49250`	vulnerable	2026-06-08 06:14:28.881574	Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Published: 2024-02-20T10:00:06.733Z Updated: 2025-02-13T17:18:36.587Z Open on db.gcve.eu Reference links https://github.com/apache/dolphinscheduler/pull/15288 https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn http://www.openwall.com/lists/oss-security/2024/02/20/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13922`	vulnerable	2026-06-08 05:18:01.377563	Apache DolphinScheduler (incubating) Permission vulnerability Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. Published: 2021-01-11T09:40:19.000Z Updated: 2025-02-13T16:27:28.158Z Open on db.gcve.eu Reference links https://www.mail-archive.com/announce%40apache.org/msg06076.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-11974`	vulnerable	2026-06-08 05:17:55.902853	Details available In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database. Published: 2020-12-18T00:00:00.000Z Updated: 2024-08-04T11:48:57.494Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/rcbe4c248ef0c566e99fd19388a6c92aeef88167286546b675e9b1769%40%3Cdev.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/ra81adacbfdd6f166f9cf155340674ffd4179386b8b75068639547c11%40%3Ccommits.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/r9fbe24539a873032b3e41243d44a730d6a2aae26335ac1e3271ea47d%40%3Ccommits.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/r33452d7b99a293bcf8f3e4bd664943847e2602e03a9e45d09d3f508a%40%3Ccommits.dolphinscheduler.apache.org%3E https://lists.apache.org/thread.html/r0de5e3d5516467c9429a8d4356eca17ccf156337345ac6b104748acb%40%3Ccommits.dolphinscheduler.apache.org%3E	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.