Apache DolphinScheduler (incubating) Permission vulnerability
CVE-2020-13922

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Dolphinscheduler
Vendor
CVE Published:
11 January 2021

What is CVE-2020-13922?

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

Affected Version(s)

Apache DolphinScheduler Apache DolphinScheduler < 1.3.2

References

https://www.mail-archive.com/announce%40apache.org/msg060...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by xuxiang of DtDream security
.