CVE-2023-50270

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

6.5

EPSS

1.31%

Published

Feb 20, 2024

Modified

Mar 18, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-613CWE-384

Affected Products (1)

apache · dolphinscheduler (up to 3.2.1)vulnerable

References (8)

https://github.com/apache/dolphinscheduler/pull/15219

Issue TrackingPatch

https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6

Vendor Advisory

https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r

Vendor Advisory

https://www.openwall.com/lists/oss-security/2024/02/20/3

Mailing ListThird Party Advisory

https://github.com/apache/dolphinscheduler/pull/15219

Issue TrackingPatch

https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6

Vendor Advisory

https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r

Vendor Advisory

https://www.openwall.com/lists/oss-security/2024/02/20/3

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs