CVE-2023-50270 Apache DolphinScheduler: Session do not expire after password change

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue...

CVE-2023-50270

Apache DolphinScheduler versions before 3.2.0 are vulnerable to Session Fixation due to improper session management within LoginController.java. Specifically, the system fails to deactivate existing sessions when a user changes their password. An attacker could exploit this by sending a specially...

CVE-2023-50270 Apache DolphinScheduler: Session do not expire after password change

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250

Apache DolphinScheduler versions before 3.2.1 are vulnerable to a Man-in-the-Middle (MITM) attack due to improper certificate validation. Specifically, the HttpUtils class fails to verify certificates during outgoing HTTPS connections, allowing an attacker to intercept traffic and impersonate the...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49109

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49109

Apache DolphinScheduler versions prior to 3.2.1 are vulnerable to Remote Code Execution (RCE) . The root cause is the improper validation of user input within the HttpTaskDefinitionParser.java file of the org.apache.dolphinscheduler:dolphinscheduler-task-api component. This flaw allows an attacke...

CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49109: Improper Control of Generation of Code

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-51770: Improper Control of Generation of Code

Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49250: Improper Certificate Validation

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

PT-2024-14287

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.2.1 Description This issue is an Arbitrary File Read Vulnerability in Apache DolphinScheduler. It is recommended that users upgrade to version 3.2.1 to fix the issue. Recommendations For versions pri...

PT-2024-13709

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.2.0 Description The issue arises because the HttpUtils class did not verify certificates, allowing an attacker to perform a Man-in-the-Middle MITM attack on outgoing https connections and impersonate...

Apache Dolphinscheduler 代码注入漏洞

Apache Dolphinscheduler is a modern data scheduling platform from the Apache USA Foundation. A code execution vulnerability exists in Apache Dolphinscheduler, which can be exploited by an attacker to execute arbitrary code on a system...

PT-2024-13890

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.2.1 Description The issue is related to session fixation, where a session remains valid after a password change. This could potentially allow unauthorized access. Users are advised to upgrade to a...