Medium severity · published Feb 20, 2024
CVE-2023-50270
Apache DolphinScheduler: Session do not expire after password change
6.5
CVSS
1.3%
EPSS
No
On KEV
Description
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
1.3.8 through 3.2.0 · source: vendor
DO
Dolphinscheduler · Apache
1.3.8 before 3.2.1 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50270
Issue Tracking
https://github.com/apache/dolphinscheduler/pull/15219
Vendor Advisory
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
Vendor Advisory
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
Mailing List
https://www.openwall.com/lists/oss-security/2024/02/20/3
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.8
CVE-2024-43166
Incorrect Default Permissions vulnerability in Apache DolphinScheduler
9.8
CVE-2024-43202
Apache DolphinScheduler: Remote Code Execution Vulnerability
9.8
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks