PT-2023-8380 · Apache · Apache Airflow

Balis0Ng + 1 · Publicado 2023-12-21 · Atualizado 2024-03-06 · CVE-2023-50783

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.8.0

Description The issue is related to improper access control in Apache Airflow, allowing an authenticated user without the variable edit permission to update a variable. This compromises the integrity of variable management and could lead to unauthorized data modification.

Recommendations For Apache Airflow versions prior to 2.8.0, upgrade to version 2.8.0 to fix the issue. As a temporary workaround, consider restricting access to the variable management feature to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2024-00576

BIT-AIRFLOW-2023-50783

CVE-2023-50783

GHSA-5938-79HG-XH3Q

PYSEC-2023-267

Produtos afetados

Apache Airflow

Referências · 19

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/33932 · Correção
• https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-267.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-50783 · Nota de Segurança
• https://github.com/advisories/GHSA-5938-79hg-xh3q · Nota
• https://twitter.com/CVEnew/status/1737769337316896878 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-50783 · Aviso do Fabricante
• https://t.me/cvenotify/65383 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-airflow-2023-50783 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/12/21/4 · Nota
• https://osv.dev/vulnerability/GHSA-5938-79hg-xh3q · Aviso do Fabricante
• https://t.me/cvenotify/64630 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-00576 · Nota de Segurança
• https://twitter.com/oss_security/status/1737865885811982490 · Publicação no Twitter