Skip to content

Session Fixation Apache DolphinScheduler

Moderate severity GitHub Reviewed Published Feb 20, 2024 to the GitHub Advisory Database • Updated Mar 3, 2024

Package

maven org.apache.dolphinscheduler:dolphinscheduler (Maven)

Affected versions

>= 1.3.8, < 3.2.1

Patched versions

3.2.1

Description

Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

References

Published by the National Vulnerability Database Feb 20, 2024
Published to the GitHub Advisory Database Feb 20, 2024
Reviewed Feb 21, 2024
Last updated Mar 3, 2024

Severity

Moderate

EPSS score

0.045%
(17th percentile)

Weaknesses

CVE ID

CVE-2023-50270

GHSA ID

GHSA-vjqc-g788-f378

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.