title: Apache DolphinScheduler: Session do not expire after password change
description: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
problem types: CWE-613 Insufficient Session Expiration
affected:
{
collectionURL: https://repo.maven.apache.org/maven2
defaultStatus: unaffected
packageName: org.apache.dolphinscheduler:dolphinscheduler-api
product: Apache DolphinScheduler
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 3.2.0, status: affected, version: 1.3.8, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]