CVE-2023-50270
Assigner: apache
Published: 2024-02-20T10:01:32.260Z
State: PUBLISHED
affected: collectionURL: https://repo.maven.apache.org/maven2
defaultStatus: unaffected
packageName: org.apache.dolphinscheduler:dolphinscheduler-api
product: Apache DolphinScheduler
vendor: Apache Software Foundation
versions: lessThanOrEqual: 3.2.0
status: affected
version: 1.3.8
versionType: semver
credits: type: finder
value: lujiefsi
type: finder
value: Qing Xu
descriptions: supportingMedia: base64: no
type: text/html
value: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.
value: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.
metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-613
description: CWE-613 Insufficient Session Expiration
type: CWE
source: discovery: UNKNOWN
title: Apache DolphinScheduler: Session do not expire after password change
x_generator: engine: Vulnogram 0.1.0-dev