Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13922
Reference (s):
- https://www.mail-archive.com/[email protected]/msg06076.html
- URL: https://www.mail-archive.com/[email protected]/msg06076.html