GitHub Advisoryadvisory · Maven

GHSA-qhh5-9738-g9mx Incorrect Default Permissions in Apache DolphinScheduler

HIGH Published 2022-02-09 Modified 2024-11-18 Official page ↗
Aliases
CVE-2020-13922
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler-api
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-276
Reviewed
2021-04-06

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler-api: < 1.3.2 → fixed in 1.3.2

Description

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

Related

Alias · CVE (1)

  • CVE-2020-13922 Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References