CVE-2023-50270CWE-613

Apache DolphinScheduler: Session do not expire after password change

Medium · published February 20, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01306 · 70.3th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2024-02-20T10:01Z
EPSS history
Timeline
  • 20 FEB 10:01Z
    Apache DolphinScheduler: Session do not expire after password change
    cvelistv5