CVE-2023-50270 Apache DolphinScheduler: Session do not expire after password change

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue...

CVE-2023-50270 Apache DolphinScheduler: Session do not expire after password change

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue...

CVE-2023-50270

Summary: CVE-2023-50270 affects Apache DolphinScheduler and relates to session fixation. The authenticated user session remains valid after a password change, enabling potential misuse. Public references from multiple sources (Red Hat, OSV, CVE notes, Veracode analysis, GitHub advisories) converg...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

CVE-2023-49250

CVE-2023-49250 affects Apache DolphinScheduler prior to 3.2.0, where the HttpUtils class fails to verify TLS certificates. This allows an attacker in a MITM position on outgoing HTTPS connections to impersonate the server, potentially impacting confidentiality, integrity, and availability of the ...

CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49109

CVE-2023-49109 affects Apache DolphinScheduler prior to 3.2.1, described as exposure of remote code execution. Public documents align on a DolphinScheduler RCE risk and advise upgrading to version 3.2.1 to mitigate. Connected sources also reference related advisories (GHSA OSV/NVD) with similar r...

CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

CVE-2023-49109 Remote Code Execution in Apache Dolphinscheduler

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue...

Apache Dolphinscheduler 代码注入漏洞

Apache Dolphinscheduler is a modern data scheduling platform from the Apache USA Foundation. A code execution vulnerability exists in Apache Dolphinscheduler, which can be exploited by an attacker to execute arbitrary code on a system...

Apache DolphinScheduler Trust Management Issue Vulnerability

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation. A trust management issue vulnerability exists in Apache DolphinScheduler versions prior to 3.2.0, which stems from the HttpUtils class not validating credentials, and thus...

Apache DolphinScheduler 代码注入漏洞

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. Apache Dolphinscheduler suffers from an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

Apache DolphinScheduler 安全漏洞

Apache Dolphinscheduler is a modern data scheduling platform from the Apache USA Foundation. The Apache DolphinScheduler security bypass vulnerability, which stems from a session not being logged off after a password change, can be exploited by an attacker to bypass access restrictions by sending...

Apache DolphinScheduler Input Validation Error Vulnerability (CNVD-2024-27495)

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. A security vulnerability exists in Apache DolphinScheduler 3.1.9 and earlier versions, which can be exploited by an unauthenticated attacker to...

Improper Input Validation

Apache DolphinScheduler is vulnerable to Improper Input Validation. The vulnerability is due improper JavaScript sanitization, which allows an authenticated user to execute arbitrary unsandboxed JavaScript on the server...

GHSA-V7HG-77V9-2445 Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

CVE-2023-49299

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

Input validation

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...