6.5med
CVE-2023-42663
Apache Airflow: Bypass permission verification to view task instances of other dags
Also known as GHSA-32wr-qqw6-5mfp, PYSEC-2023-197
Published 3 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known
Summary
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Exploit prediction (EPSS)
2.01% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | apache-airflow | <2.7.2 | 2.7.2 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- github.com /apache/airflow/pull/34315 · patch, x_transferred
- lists.apache.org /thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 · vendor-advisory, x_transferred
- openwall.com /lists/oss-security/2023/11/12/2 · x_transferred
- nvd.nist.gov /vuln/detail/CVE-2023-42663 · advisory
- github.com /apache/airflow · package
- github.com /pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-197.yaml · web
- github.com /advisories/GHSA-32wr-qqw6-5mfp · advisory
Sources
- CVE List: CVE-2023-42663
- GitHub Advisory: GHSA-32wr-qqw6-5mfp
- NVD: CVE-2023-42663
- OSV: PYSEC-2023-197
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.