CVE-2023-37415

Katalog CVE

CVSS 8.8 · High EPSS 1,6%

Kerentanan Improper Input Validation pada apache-airflow-providers-apache-hive. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

Rincian

Terbit di NVD

13 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2023/07/12/3 mailing list · advisory pihak ketiga