{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"apache-dolphinscheduler","cve_ids":["CVE-2020-13922"],"ecosystem":"PyPI","epss":0.0175,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qhh5-9738-g9mx","id":"tcs_01M5KGFRY13AQCA6RE7GVQ9P5S","modified_at":"2025-10-09T08:20:38.443372Z","published_at":"2021-01-11T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-876","https://www.mail-archive.com/announce%40apache.org/msg06076.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2021-876","url":"https://osv.dev/vulnerability/PYSEC-2021-876"}],"summary":"Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface."}