github - ghsa-vjqc-g788-f378

ghsa-vjqc-g788-f378

Vulnerability from github

Published

2024-02-20 12:31

Modified

2024-02-23 15:16

Summary

Session Fixation Apache DolphinScheduler

Details

Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.dolphinscheduler:dolphinscheduler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.8"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-50270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-21T00:21:28Z",
    "nvd_published_at": "2024-02-20T10:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue.",
  "id": "GHSA-vjqc-g788-f378",
  "modified": "2024-02-23T15:16:50Z",
  "published": "2024-02-20T12:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50270"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/dolphinscheduler/pull/15219"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/dolphinscheduler"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/02/20/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Session Fixation Apache DolphinScheduler"
}

cve-2023-50270

Vulnerability from cvelistv5

Published

2024-02-20 10:01

Modified

2024-08-29 15:08

Severity ?

Summary

Apache DolphinScheduler: Session do not expire after password change

References

▼	URL	Tags
	https://github.com/apache/dolphinscheduler/pull/15219	patch
	https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r	vendor-advisory
	https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6	vendor-advisory
	https://www.openwall.com/lists/oss-security/2024/02/20/3

Impacted products

▼	Vendor	Product
	Apache Software Foundation	Apache DolphinScheduler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/apache/dolphinscheduler/pull/15219"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dolphinscheduler",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "3.2.0",
                "status": "affected",
                "version": "1.3.8",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-50270",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T17:07:02.901267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-384",
                "description": "CWE-384 Session Fixation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T15:08:36.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api",
          "product": "Apache DolphinScheduler",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "3.2.0",
              "status": "affected",
              "version": "1.3.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lujiefsi"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Qing Xu"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.2.1, which fixes this issue."
            }
          ],
          "value": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-23T10:17:35.425Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/dolphinscheduler/pull/15219"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2024/02/20/3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache DolphinScheduler: Session do not expire after password change",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-50270",
    "datePublished": "2024-02-20T10:01:32.260Z",
    "dateReserved": "2023-12-06T02:25:09.094Z",
    "dateUpdated": "2024-08-29T15:08:36.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted