dolphinschedulerGHSA-vjqc-g788-f378
Session Fixation Apache DolphinScheduler
MediumCVE-2023-50270 · Published Feb 20, 2024 · updated Nov 30, 2024
Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 1.3.8, < 3.2.1 | 3.2.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-613
- Also known as
- CVE-2023-50270
- nvd.nist.gov/vuln/detail/CVE-2023-50270
- github.com/apache/dolphinscheduler/pull/15219
- github.com/apache/dolphinscheduler
- lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
- lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
- www.openwall.com/lists/oss-security/2024/02/20/3
- www.openwall.com/lists/oss-security/2024/02/20/3
More dolphinscheduler advisories
All dolphinscheduler| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 122024 | Apache DolphinScheduler: RCE by arbitrary js execution High8.8Aug 12, 2024 | High8.8 | 3.2.2 |
| Aug 122024 | Apache DolphinScheduler: Resource File Read And Write VulnerabilityHigh8.1Aug 12, 2024 | High8.1 | 3.2.2 |
| Feb 202024 | Improper Certificate Validation in Apache DolphinSchedulerHigh7.3Feb 20, 2024 | High7.3 | 3.2.1 |
| Feb 202024 | Arbitrary File Read Vulnerability in Apache DolphinschedulerHigh7.5Feb 20, 2024 | High7.5 | 3.2.1 |
| Feb 202024 | Remote Code Execution in Apache DolphinschedulerCritical9.8Feb 20, 2024 | Critical9.8 | 3.2.1 |
| Nov 242023 | Apache DolphinScheduler sensitive information disclosureHigh7.5Nov 24, 2023 | High7.5 | 3.0.2 |