CVE-2023-50270

Apache DolphinScheduler: Session do not expire after password change

CVSS 6.5 MEDIUMEPSS 1.3%CWE-384 CWE-613

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Apache Software Foundation · Apache DolphinScheduler

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/apache/dolphinscheduler/pull/15219 https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r https://www.openwall.com/lists/oss-security/2024/02/20/3