GHSA-qhh5-9738-g9mx

Incorrect Default Permissions in Apache DolphinScheduler

Source: GitHub Advisory Database (reviewed) High CVE-2020-13922

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.dolphinscheduler:dolphinscheduler-api	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-13922 advisory
https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1 web
https://github.com/apache/incubator-dolphinscheduler package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml web
https://www.mail-archive.com/announce%40apache.org/msg06076.html web
https://www.mail-archive.com/[email protected]/msg06076.html web