CVE-2023-50270 - Vulnerability Details - OpenCVE

ReportizFlow

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/apache/dolphinscheduler/pull/15219
https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6
https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
https://www.openwall.com/lists/oss-security/2024/02/20/3

History

Thu, 29 Aug 2024 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-384
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-02-20T10:01:32.260Z

Updated: 2024-08-29T15:08:36.166Z

Reserved: 2023-12-06T02:25:09.094Z

Link: CVE-2023-50270

Vulnrichment

Updated: 2024-08-02T22:16:46.169Z

NVD

Status : Awaiting Analysis

Published: 2024-02-20T10:15:08.140

Modified: 2024-11-21T08:36:47.543

Link: CVE-2023-50270

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50270", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-12-06T02:25:09.094Z", "datePublished": "2024-02-20T10:01:32.260Z", "dateUpdated": "2024-08-29T15:08:36.166Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api", "product": "Apache DolphinScheduler", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.2.0", "status": "affected", "version": "1.3.8", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "lujiefsi"}, {"lang": "en", "type": "finder", "value": "Qing Xu"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue."}], "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-23T10:17:35.425Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/dolphinscheduler/pull/15219"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache DolphinScheduler: Session do not expire after password change", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.169Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/apache/dolphinscheduler/pull/15219"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-384", "lang": "en", "description": "CWE-384 Session Fixation"}]}], "affected": [{"vendor": "apache", "product": "dolphinscheduler", "cpes": ["cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.3.8", "status": "affected", "lessThanOrEqual": "3.2.0", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-20T17:07:02.901267Z", "id": "CVE-2023-50270", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T15:08:36.166Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/apache/dolphinscheduler/pull/15219", "tags": ["patch", "x_transferred"]}, {"url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.169Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-50270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-20T17:07:02.901267Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "dolphinscheduler", "versions": [{"status": "affected", "version": "1.3.8", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384 Session Fixation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T15:08:30.902Z"}}], "cna": {"title": "Apache DolphinScheduler: Session do not expire after password change", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "lujiefsi"}, {"lang": "en", "type": "finder", "value": "Qing Xu"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache DolphinScheduler", "versions": [{"status": "affected", "version": "1.3.8", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/dolphinscheduler/pull/15219", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r", "tags": ["vendor-advisory"]}, {"url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6", "tags": ["vendor-advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-23T10:17:35.425Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50270", "state": "PUBLISHED", "dateUpdated": "2024-08-29T15:08:36.166Z", "dateReserved": "2023-12-06T02:25:09.094Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-02-20T10:01:32.260Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue."}, {"lang": "es", "value": "Correcci\u00f3n de sesi\u00f3n de Apache DolphinScheduler anterior a la versi\u00f3n 3.2.0, cuya sesi\u00f3n sigue siendo v\u00e1lida despu\u00e9s del cambio de contrase\u00f1a. Se recomienda a los usuarios actualizar a la versi\u00f3n 3.2.1, que soluciona este problema."}], "id": "CVE-2023-50270", "lastModified": "2024-11-21T08:36:47.543", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-02-20T10:15:08.140", "references": [{"source": "[email protected]", "url": "https://github.com/apache/dolphinscheduler/pull/15219"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"}, {"source": "[email protected]", "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"}, {"source": "[email protected]", "url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/apache/dolphinscheduler/pull/15219"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-384"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}