Apache Airflow: Bypass permission verification to view task instances of other dags (Apache Software Foundation Apache Airflow)
En bref
- Source
- NVD
- EPSS
- EPSS 2.01 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Modified
Description
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-32wr-qqw6-5mfp — Apache Airflow vulnerable to sensitive information exposure
- PYSEC-2023-197 — Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about t
Références européennes
- ENISA EUVD · EUVD-2023-0020
- GCVE · GCVE-0-2023-42663
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*< 2.7.2
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Airflow | affected 0 < 2.7.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |