PT-2023-4774 · Apache · Apache Airflow

Ephraim Anierobi · Publicado 2023-07-12 · Atualizado 2026-02-20 · CVE-2022-46651

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.3

Description The issue allows an unauthorized actor to gain access to sensitive information in the Connection edit view. This is considered a low-risk vulnerability as it requires access to Connection resources and specific actions to exploit.

Recommendations For versions prior to 2.6.3, upgrade to version 2.6.3 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2023-05221

BIT-AIRFLOW-2022-46651

CVE-2022-46651

GHSA-XVW9-3MHM-XJQQ

PYSEC-2023-103

Produtos afetados

Apache Airflow

Referências · 15

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/32309 · Correção
• https://github.com/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml · Nota
• https://osv.dev/vulnerability/BIT-airflow-2022-46651 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xvw9-3mhm-xjqq · Aviso do Fabricante
• https://t.me/cibsecurity/66525 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-46651 · Nota de Segurança
• https://t.me/cvenotify/54125 · Publicação no Telegram
• https://github.com/advisories/GHSA-xvw9-3mhm-xjqq · Nota
• https://osv.dev/vulnerability/PYSEC-2023-103 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2022-46651 · Aviso do Fabricante
• https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-46651 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05221 · Nota de Segurança