CVE-2023-42792: apache airflow

csirt@kutim:~/threat-intel/cve/CVE-2023-42792

CVSS 6.5 · Medium EPSS 1,4%

Kerentanan Exposure of Resource to Wrong Sphere pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Rincian

Terbit di NVD: 14 Oktober 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-668: Exposure of Resource to Wrong Sphere
EPSS (30 hari): 1,4% peluang dieksploitasi; lebih tinggi dari 72,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	airflow	Semua versi sebelum 2.7.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq mailing list · advisory vendor
https://github.com/apache/airflow/pull/34366 patch
http://www.openwall.com/lists/oss-security/2023/12/21/1

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.