Sign in
Deutsch English Español Polski
High

Improper Certificate Validation in Apache DolphinScheduler

  • Disclosed: 20.02.2024
  • Updated: 11.10.2026 12:21

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.1.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.dolphinscheduler:dolphinscheduler < 3.2.1 3.2.1

References

CVSS score 7.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE)
CWE-295
Platform
Java / Kotlin (Maven)
Package
org.apache.dolphinscheduler:dolphinscheduler
Disclosed
20.02.2024
Updated
11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-37gx-jqx9-fwmg - CC BY 4.0

Vulnerability history: org.apache.dolphinscheduler:dolphinscheduler

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (17) in the archive
Total entries
17
First → latest
02.2022 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 9
  • Medium 4
  • Low 1

Disclosures per year

Severity:
  1. Apache DolphinScheduler has an Incorrect Authorization Vulnerability
    High · 8.1 CVE-2026-23902 < 3.4.1 3.4.1
  2. Apache DolphinScheduler vulnerable to sensitive information disclosure
    High · 7.5 CVE-2025-62188 >= 3.1.0, < 3.2.0 3.2.0
  3. Apache DolphinScheduler vulnerable to Alert Script Attack
    High · 8.8 CVE-2024-43115 < 3.2.2 3.2.2
  4. Apache DolphinScheduler: RCE by arbitrary js execution
    High · 8.8 CVE-2024-29831 < 3.2.2 3.2.2
  5. Apache DolphinScheduler: Resource File Read And Write Vulnerability
    High · 8.1 CVE-2024-30188 >= 3.1.0, < 3.2.2 3.2.2
  6. Improper Certificate Validation in Apache DolphinScheduler this entry
    High · 7.3 CVE-2023-49250 < 3.2.1 3.2.1
  7. Arbitrary File Read Vulnerability in Apache Dolphinscheduler
    High · 7.5 CVE-2023-51770 < 3.2.1 3.2.1
  8. Remote Code Execution in Apache Dolphinscheduler
    Critical · 9.8 CVE-2023-49109 >= 3.0.0, < 3.2.1 3.2.1
  9. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
    High · 7.5 CVE-2023-48796 >= 3.0.0, < 3.0.2 3.0.2
  10. Apache DolphinScheduler vulnerable to Improper Input Validation
    Critical · 9.8 CVE-2022-45875 < 3.0.2, >= 3.1.0, < 3.1.1 3.0.2, 3.1.1
  11. Uncontrolled Resource Consumption in Apache DolphinScheduler
    High · 7.5 CVE-2022-25598 < 2.0.5 2.0.5
  12. Remote code execution in DolphinScheduler
    Critical · 9.8 CVE-2020-11974 < 1.3.0 1.3.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.