CVE-2020-13922: Apache DolphinScheduler (incubating) Permission vulnerability
Published Jan 11, 2021
·Updated
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Affected Software
4 affected componentsFixes available
Apache Dolphinscheduler=1.2.0
Apache Dolphinscheduler=1.2.1
Apache Dolphinscheduler=1.3.1
maven/org.apache.dolphinscheduler:dolphinscheduler-api<1.3.2
1.3.2
Event History
Jan 11, 2021
CVE Published
via MITRE·09:40 AM
Data Sourced
via MITRE·09:40 AM
DescriptionWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Feb 9, 2022
Advisory Published
10:26 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-13922?
The severity of CVE-2020-13922 is medium with a CVSS score of 6.5.
2
How does CVE-2020-13922 affect Apache DolphinScheduler?
Versions of Apache DolphinScheduler prior to 1.3.2 are affected by CVE-2020-13922.
3
What is the vulnerability of CVE-2020-13922?
CVE-2020-13922 allowed an ordinary user under any tenant to override another user's password through the API interface.
4
How can I fix CVE-2020-13922?
To fix CVE-2020-13922, upgrade to Apache DolphinScheduler version 1.3.2 or later.
5
Where can I find more information about CVE-2020-13922?
You can find more information about CVE-2020-13922 on the Apache DolphinScheduler's official website and the NIST NVD website.