CVE-2023-50270
20.02.2024, 10:15
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | dolphinscheduler | 3.2.0 ≤ 𝑥 ≤ 3.2.0 |
| apache | dolphinscheduler | 1.3.8 ≤ 𝑥 < 3.2.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-613 - Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
- CWE-384 - Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
References