Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-13922

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

VectorNETWORK

PublishedJan 11, 2021, 10:15

Published Bysecurity@apache.org

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.dolphinscheduler:dolphinscheduler-api(Maven)01.3.2N/A

References

https://www.mail-archive.com/announce%40apache.org/msg06076.html

Weakness Type

CWE-276

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK