CVE-2020-13922
2 advisories.
PyPI/apache-dolphinscheduler CVE-2020-13922: medium 6.5, EPSS 1.75%
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
CVE-2020-13922 · published · modified · JSON
Maven/org.apache.dolphinscheduler:dolphinscheduler-api CVE-2020-13922: medium 6.5, EPSS 1.75%
Incorrect Default Permissions in Apache DolphinScheduler
Action: Upgrade org.apache.dolphinscheduler:dolphinscheduler-api to 1.3.2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.2 | - |
Fixed versions
| 1.3.2 |
Sources
- osv: GHSA-qhh5-9738-g9mx
- https://nvd.nist.gov/vuln/detail/CVE-2020-13922
- https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1
- https://github.com/apache/incubator-dolphinscheduler
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml
- https://www.mail-archive.com/announce%40apache.org/msg06076.html
- https://www.mail-archive.com/announce@apache.org/msg06076.html
CVE-2020-13922 · published · modified · JSON