apache/incubator-dolphinscheduler · Security
Incorrect Default Permissions in Apache DolphinScheduler
- GHSA ID
- GHSA-qhh5-9738-g9mx
- CVE ID
- CVE-2020-13922
- Severity
- high
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS v4
- 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
CWEs
- CWE-276 · Incorrect Default Permissions
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-13922 ↗
- https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1 ↗
- https://www.mail-archive.com/[email protected]/msg06076.html ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml ↗
- https://www.mail-archive.com/announce%40apache.org/msg06076.html ↗
- https://github.com/advisories/GHSA-qhh5-9738-g9mx ↗