CVE-2024-45498

Katalog CVE

CVSS 8.8 · High EPSS 1,2%

Kerentanan Improper Encoding or Escaping of Output pada apache airflow. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873  for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.

Rincian

Terbit di NVD

7 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n mailing list · advisory vendor
• https://github.com/apache/airflow/pull/41873 issue tracking
• http://www.openwall.com/lists/oss-security/2024/09/06/2 mailing list