PT-2023-4777 · Apache · Apache Airflow

Kietna + 2 · Publicado 2023-07-12 · Atualizado 2026-02-20 · CVE-2023-22887

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.3

Description The issue allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run id parameter. This is considered a low-risk issue as it requires an authenticated user to exploit it.

Recommendations For Apache Airflow versions prior to 2.6.3, upgrade to a version that is not affected to resolve the issue. As a temporary workaround, consider restricting access to the run id parameter to minimize the risk of exploitation.

Correção

DoS

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-05224

BIT-AIRFLOW-2023-22887

CVE-2023-22887

GHSA-GGWR-4VR8-G7WV

PYSEC-2023-104

Produtos afetados

Apache Airflow

Referências · 14

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/32293 · Correção
• https://github.com/apache/airflow/commit/05bd90f563649f2e9c8f0c85cf5838315a665a02 · Nota
• https://github.com/apache/airflow/commit/8ff7dfbd9e76aa40b04adeb231df3820606f5ba3 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-104.yaml · Nota
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-22887 · Aviso do Fabricante
• https://github.com/advisories/GHSA-ggwr-4vr8-g7wv · Nota
• https://osv.dev/vulnerability/BIT-airflow-2023-22887 · Aviso do Fabricante
• https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22887 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22887 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ggwr-4vr8-g7wv · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05224 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-104 · Aviso do Fabricante