Description
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Remediation
References
https://www.mail-archive.com/announce%40apache.org/msg06076.html
Related Vulnerabilities
CVE-2014-0002 Vulnerability in maven package org.apache.camel:camel-core
CVE-2013-6373 Vulnerability in maven package org.jenkins-ci.plugins:exclusion
CVE-2013-4152 Vulnerability in maven package org.springframework:spring-oxm
CVE-2014-0229 Vulnerability in maven package org.apache.hadoop:hadoop-hdfs
CVE-2009-2901 Vulnerability in maven package org.apache.tomcat:catalina