CVE-2023-50270

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613 CWE-384

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	>= 1.3.8, <= 3.2.0
apache	dolphinscheduler	>= 1.3.8, <= 3.2.0

References

https://github.com/apache/dolphinscheduler/pull/15219Issue Tracking, Patch
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6Vendor Advisory
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9rVendor Advisory
https://www.openwall.com/lists/oss-security/2024/02/20/3Mailing List, Third Party Advisory
https://github.com/apache/dolphinscheduler/pull/15219Issue Tracking, Patch
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6Vendor Advisory
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9rVendor Advisory
https://www.openwall.com/lists/oss-security/2024/02/20/3Mailing List, Third Party Advisory

Timeline

Published: Feb 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-502717.5A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited lo CVE-2023-502729.8A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulne CVE-2023-502747.8HPE OneView may allow command injection with local privilege escalation.CVE-2023-502757.5HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.CVE-2023-50284.6A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue CVE-2023-50298.8A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/cop CVE-2023-502906.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected envi CVE-2023-502917.5Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 be CVE-2023-502927.5Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. CVE-2023-502946.5The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret CVE-2023-502976.1Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arb CVE-2023-502987.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8