CVEvulnerability
CVE-2023-50270
6.5 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-02-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-384, CWE-613
Description
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Affected configurations
• apache dolphinscheduler (>= 1.3.8 < 3.2.1)
Related
Weakness · not in database (1)
Weakness · CWE (1)
- CWE-384 Session Fixation weakness
References
- https://github.com/apache/dolphinscheduler/pull/15219 Issue Tracking, Patch
- https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 Vendor Advisory
- https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r Vendor Advisory
- https://www.openwall.com/lists/oss-security/2024/02/20/3 Mailing List, Third Party Advisory
- https://github.com/apache/dolphinscheduler/pull/15219 Issue Tracking, Patch
- https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 Vendor Advisory
- https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r Vendor Advisory
- https://www.openwall.com/lists/oss-security/2024/02/20/3 Mailing List, Third Party Advisory