Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p7d8-kg27-nbee
Vulnerability ID VCID-p7d8-kg27-nbee
Aliases CVE-2023-51770
GHSA-ff2w-wm48-jhqj
Summary Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01343 https://api.first.org/data/v1/epss?cve=CVE-2023-51770
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-ff2w-wm48-jhqj
cvssv3.1 7.5 https://github.com/apache/dolphinscheduler
generic_textual HIGH https://github.com/apache/dolphinscheduler
cvssv3.1 7.5 https://github.com/apache/dolphinscheduler/pull/15433
generic_textual HIGH https://github.com/apache/dolphinscheduler/pull/15433
ssvc Track https://github.com/apache/dolphinscheduler/pull/15433
cvssv3.1 7.5 https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
generic_textual HIGH https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
ssvc Track https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
cvssv3.1 7.5 https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
generic_textual HIGH https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
ssvc Track https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-51770
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-51770
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2024/02/20/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/02/20/2
ssvc Track http://www.openwall.com/lists/oss-security/2024/02/20/2
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-51770
https://github.com/apache/dolphinscheduler
https://github.com/apache/dolphinscheduler/pull/15433
https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
http://www.openwall.com/lists/oss-security/2024/02/20/2
CVE-2023-51770 https://nvd.nist.gov/vuln/detail/CVE-2023-51770
GHSA-ff2w-wm48-jhqj https://github.com/advisories/GHSA-ff2w-wm48-jhqj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/dolphinscheduler
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/dolphinscheduler/pull/15433
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/ Found at https://github.com/apache/dolphinscheduler/pull/15433
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/ Found at https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/ Found at https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-51770
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2024/02/20/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:29:47Z/ Found at http://www.openwall.com/lists/oss-security/2024/02/20/2
Exploit Prediction Scoring System (EPSS)
Percentile 0.80396
EPSS Score 0.01343
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:47:09.637297+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.dolphinscheduler/dolphinscheduler/CVE-2023-51770.yml 38.6.0