Medium severity · published Jan 11, 2021
CVE-2020-13922
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface
6.5
CVSS
1.8%
EPSS
No
On KEV
Description
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolphinscheduler · Apache
1.2.0; 1.2.1; 1.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13922
www.mail-archive.com
https://www.mail-archive.com/announce%40apache.org/msg06076.html
More from Dolphinscheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.8
CVE-2024-43166
Incorrect Default Permissions vulnerability in Apache DolphinScheduler
9.8
CVE-2024-43202
Exposure of Remote Code Execution in Apache Dolphinscheduler
9.8
CVE-2023-49109
Exposure of Remote Code Execution in Apache Dolphinscheduler
9.8
CVE-2022-45875
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability