CVE-2023-37379

Katalog CVE

CVSS 8.1 · High EPSS 2,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada apache airflow. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.

Rincian

Terbit di NVD

23 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-400: Uncontrolled Resource Consumption
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r advisory vendor
• https://github.com/apache/airflow/pull/32052 patch
• http://www.openwall.com/lists/oss-security/2023/08/23/4 mailing list · advisory pihak ketiga