PT-2021-9678 · Apache · Apache Dolphinscheduler

Xuxiang + 1 · Published 2021-01-11 · Updated 2022-02-09 · CVE-2020-13922

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 1.3.2

Description The issue allows an ordinary user under any tenant to override another user's password through the API interface.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the API interface to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-264

CWE-276

Related Identifiers

CVE-2020-13922

GHSA-QHH5-9738-G9MX

PYSEC-2021-876

Affected Products

Apache Dolphinscheduler

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-13922 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13922 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhh5-9738-g9mx · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-876 · Vendor Advisory
• https://github.com/apache/incubator-dolphinscheduler · Note
• https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml · Note
• https://t.me/cvenotify/8401 · Telegram Post
• https://mail-archive.com/[e-mail]/msg06076.html · Note
• https://t.me/cvenotify/8409 · Telegram Post
• https://t.me/cvenotify/8548 · Telegram Post
• https://t.me/cibsecurity/21897 · Telegram Post
• https://mail-archive.com/announce%40apache.org/msg06076.html · Note