PT-2023-6332 · Apache · Apache Airflow

Balis0Ng + 1 · Publicado 2023-10-13 · Atualizado 2024-03-06 · CVE-2023-42792

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.2

Description The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus enabling the user to clear DAGs they shouldn't. This is related to the disclosure of information in the error data area. Exploitation of the vulnerability may allow a remote attacker to impact data integrity.

Recommendations For Apache Airflow versions prior to 2.7.2, upgrade to version 2.7.2 or newer to mitigate the risk associated with this issue.

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

BDU:2023-07044

BIT-AIRFLOW-2023-42792

CVE-2023-42792

GHSA-J3W8-2P2H-MRR9

PYSEC-2023-203

Produtos afetados

Apache Airflow

Referências · 17

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/34366 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-203.yaml · Nota
• https://t.me/cibsecurity/72282 · Publicação no Telegram
• https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j3w8-2p2h-mrr9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-42792 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42792 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-203 · Aviso do Fabricante
• https://twitter.com/NUYTSTECH/status/1715279698354446831 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2023/12/21/1 · Nota
• https://t.me/cvenotify/64644 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-airflow-2023-42792 · Aviso do Fabricante
• https://github.com/advisories/GHSA-j3w8-2p2h-mrr9 · Nota
• https://t.me/cvenotify/65381 · Publicação no Telegram