CVE-2023-47037

Katalog CVE

CVSS 4.3 · Medium EPSS 1,5%

Kerentanan Incorrect Authorization pada apache airflow. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.  Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.  Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Rincian

Terbit di NVD

12 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apache/airflow/pull/33413 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2023/11/12/1 mailing list · advisory pihak ketiga
• https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 mailing list