CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50270 – Apache DolphinScheduler: Session do not expire after password change
https://notcve.org/view.php?id=CVE-2023-50270
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue. Corrección de sesión de Apache DolphinScheduler anterior a la versión 3.2.0, cuya sesión sigue siendo válida después del cambio de contraseña. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona este problema. • https://github.com/apache/dolphinscheduler/pull/15219 https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r https://www.openwall.com/lists/oss-security/2024/02/20/3 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49250 – Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
https://notcve.org/view.php?id=CVE-2023-49250
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Debido a que la clase HttpUtils no verificó los certificados, un atacante que pudiera realizar un ataque Man-in-the-Middle (MITM) en conexiones https salientes podría hacerse pasar por el servidor. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.0. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/1 https://github.com/apache/dolphinscheduler/pull/15288 https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49109 – Remote Code Execution in Apache Dolphinscheduler
https://notcve.org/view.php?id=CVE-2023-49109
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Exposición de la ejecución remota de código en Apache Dolphinscheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. Recomendamos a los usuarios que actualicen Apache DolphinScheduler a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/4 https://github.com/apache/dolphinscheduler/pull/14991 https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8 https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5 • CWE-94: Improper Control of Generation of Code ('Code Injection') •