{"action":"Upgrade org.apache.dolphinscheduler:dolphinscheduler-common to 2.0.6 or later.","affected":[{"fixed":"2.0.6","introduced":"0"}],"component":"org.apache.dolphinscheduler:dolphinscheduler-common","cve_ids":["CVE-2022-26885"],"ecosystem":"Maven","epss":0.01362,"exploited":false,"fixed_versions":["2.0.6"],"ghsa_id":"GHSA-jvc3-wjf6-7c6c","id":"tcs_01M5N93PQ5TQ195H976057T3EB","modified_at":"2023-11-08T04:08:55.282785Z","published_at":"2022-11-24T18:30:28Z","references":["https://osv.dev/vulnerability/GHSA-jvc3-wjf6-7c6c","https://nvd.nist.gov/vuln/detail/CVE-2022-26885","https://github.com/apache/dolphinscheduler","https://github.com/apache/dolphinscheduler/releases/tag/2.0.6","https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-jvc3-wjf6-7c6c","url":"https://osv.dev/vulnerability/GHSA-jvc3-wjf6-7c6c"}],"summary":"Apache Dolphin Scheduler has insufficiently protected credentials"}