Description (CNA)
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache DolphinScheduler | affected 1.3.8 through 3.2.0 |
CWE
CWE-613
References
- https://github.com/apache/dolphinscheduler/pull/15219
- https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
- https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
- https://www.openwall.com/lists/oss-security/2024/02/20/3
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.