CVE-2023-50270
MEDIUMCVSS 6.5/10EPSS 1.31%
Last modified
CVE-2023-50270 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.. EPSS estimates a 1.31% chance of exploitation in the next 30 days.
Description
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Dolphinscheduler | >= 1.3.8, < 3.2.1 |
References
- https://github.com/apache/dolphinscheduler/pull/15219Issue Tracking, Patch
- https://www.openwall.com/lists/oss-security/2024/02/20/3Mailing List, Third Party Advisory
- https://github.com/apache/dolphinscheduler/pull/15219Issue Tracking, Patch
- https://www.openwall.com/lists/oss-security/2024/02/20/3Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-50270?
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
How severe is CVE-2023-50270?
CVE-2023-50270 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 1.31% probability of exploitation in the next 30 days.
How do I fix CVE-2023-50270?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-50265Bazarr manages and downloads subtitles. Prior to 1.3.1, the …7.5
- CVE-2023-50266Bazarr manages and downloads subtitles. In version 1.2.4, th…5.3
- CVE-2023-50267MeterSphere is a one-stop open source continuous testing pla…4.3
- CVE-2023-50268jq is a command-line JSON processor. Version 1.7 is vulnerab…5.5
- CVE-2023-50269Squid is a caching proxy for the Web. Due to an Uncontrolled…7.5
- CVE-2023-5027A vulnerability classified as critical was found in SourceCo…7.5
- CVE-2023-50271 A potential security vulnerability has been identified with…7.5
- CVE-2023-50272A potential security vulnerability has been identified in HP…9.8
- CVE-2023-50274HPE OneView may allow command injection with local privilege…7.8
- CVE-2023-50275HPE OneView may allow clusterService Authentication Bypass r…7.5
- CVE-2023-5028A vulnerability, which was classified as problematic, has be…4.6
- CVE-2023-5029A vulnerability, which was classified as critical, was found…8.8
Are you affected by CVE-2023-50270?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST