Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-50270 EUVD-2024-0737GHSA-vjqc-g788-f378

Apache DolphinScheduler: Session do not expire after password change

Published Feb 20, 2024 · Updated Aug 29, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler Package: org.apache.dolphinscheduler:dolphinscheduler Ecosystem: Maven

Description

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler 1.3.8 – ≤ 3.2.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dolphinscheduler:dolphinscheduler >= 1.3.8, < 3.2.1 3.2.1 GHSA-vjqc-g788-f378

References