CVE-2023-50944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50944
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/01/24/5 Mailing List
https://github.com/apache/airflow/pull/36257 Third Party Advisory
https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
History

30 Jan 2024, 22:58

Type Values Removed Values Added
CPE cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
First Time Apache
Apache airflow
References () http://www.openwall.com/lists/oss-security/2024/01/24/5 - () http://www.openwall.com/lists/oss-security/2024/01/24/5 - Mailing List
References () https://github.com/apache/airflow/pull/36257 - () https://github.com/apache/airflow/pull/36257 - Third Party Advisory
References () https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - () https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - Mailing List, Vendor Advisory

24 Jan 2024, 15:15

Type Values Removed Values Added
Summary
  • (es) Apache Airflow, versiones anteriores a la 2.8.1, tienen una vulnerabilidad que permite a un usuario autenticado acceder al código fuente de un DAG al que no tiene acceso. Esta vulnerabilidad se considera baja ya que requiere un usuario autenticado para explotarla. Se recomienda a los usuarios actualizar a la versión 2.8.1, que soluciona este problema.
References
  • () http://www.openwall.com/lists/oss-security/2024/01/24/5 -

24 Jan 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-24 13:15

Updated : 2024-01-30 22:58

NVD link : CVE-2023-50944

Mitre link : CVE-2023-50944

CVE.ORG link : CVE-2023-50944

JSON object : View

Products Affected

apache

  • airflow
CWE
CWE-862

Missing Authorization