CVE-2023-50270

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50270
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/dolphinscheduler/pull/15219 Issue Tracking Patch
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 Vendor Advisory
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r Vendor Advisory
https://www.openwall.com/lists/oss-security/2024/02/20/3 Mailing List Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15219 Issue Tracking Patch
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 Vendor Advisory
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r Vendor Advisory
https://www.openwall.com/lists/oss-security/2024/02/20/3 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
History

18 Mar 2025, 17:38

Type Values Removed Values Added
CPE cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
First Time Apache dolphinscheduler
Apache
References () https://github.com/apache/dolphinscheduler/pull/15219 - () https://github.com/apache/dolphinscheduler/pull/15219 - Issue Tracking, Patch
References () https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 - () https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 - Vendor Advisory
References () https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r - () https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r - Vendor Advisory
References () https://www.openwall.com/lists/oss-security/2024/02/20/3 - () https://www.openwall.com/lists/oss-security/2024/02/20/3 - Mailing List, Third Party Advisory

21 Nov 2024, 08:36

Type Values Removed Values Added
References () https://github.com/apache/dolphinscheduler/pull/15219 - () https://github.com/apache/dolphinscheduler/pull/15219 -
References () https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 - () https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 -
References () https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r - () https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r -
References () https://www.openwall.com/lists/oss-security/2024/02/20/3 - () https://www.openwall.com/lists/oss-security/2024/02/20/3 -

29 Aug 2024, 20:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-384

23 Feb 2024, 11:15

Type Values Removed Values Added
References
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/02/20/3', 'source': 'security@apache.org'}
  • () https://www.openwall.com/lists/oss-security/2024/02/20/3 -

20 Feb 2024, 13:15

Type Values Removed Values Added
Summary
  • (es) Corrección de sesión de Apache DolphinScheduler anterior a la versión 3.2.0, cuya sesión sigue siendo válida después del cambio de contraseña. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona este problema.
References
  • () http://www.openwall.com/lists/oss-security/2024/02/20/3 -

20 Feb 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-20 10:15

Updated : 2025-03-18 17:38

NVD link : CVE-2023-50270

Mitre link : CVE-2023-50270

CVE.ORG link : CVE-2023-50270

JSON object : View

Products Affected

apache

  • dolphinscheduler
CWE
CWE-613

Insufficient Session Expiration

CWE-384

Session Fixation