GitHub Advisoryadvisory · Maven
GHSA-vjqc-g788-f378 Session Fixation Apache DolphinScheduler
MEDIUM
Official page ↗
- Aliases
- CVE-2023-50270
- Ecosystem
- Maven
- Packages
- org.apache.dolphinscheduler:dolphinscheduler
- Severity
- Moderate
- Weaknesses
- CWE-613
- Reviewed
- 2024-02-21
Affected packages
• Maven org.apache.dolphinscheduler:dolphinscheduler: >= 1.3.8, < 3.2.1 → fixed in 3.2.1
Description
Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2023-50270 Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-50270 advisory
- https://github.com/apache/dolphinscheduler/pull/15219 web
- https://github.com/apache/dolphinscheduler package
- https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 web
- https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r web
- https://www.openwall.com/lists/oss-security/2024/02/20/3 web
- http://www.openwall.com/lists/oss-security/2024/02/20/3 web