Advisoriesby IbisdolphinschedulerGHSA-vjqc-g788-f378
Session Fixation Apache DolphinScheduler
Fix: upgrade to 3.2.1 or later
Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 1.3.8, < 3.2.1 | 3.2.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-613
- Also known as
- CVE-2023-50270
- nvd.nist.gov/vuln/detail/CVE-2023-50270
- github.com/apache/dolphinscheduler/pull/15219
- github.com/apache/dolphinscheduler
- lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
- lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
- www.openwall.com/lists/oss-security/2024/02/20/3
- www.openwall.com/lists/oss-security/2024/02/20/3
More dolphinscheduler advisories
All dolphinscheduler
Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2Improper Certificate Validation in Apache DolphinSchedulerCVE-2023-49250fixed in 3.2.1Arbitrary File Read Vulnerability in Apache DolphinschedulerCVE-2023-51770fixed in 3.2.1Remote Code Execution in Apache DolphinschedulerCVE-2023-49109fixed in 3.2.1Apache DolphinScheduler sensitive information disclosureCVE-2023-48796fixed in 3.0.2