CVE-2023-48291

Published: Dic 21, 2023 Last Modified: Nov 21, 2024
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.

This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 

Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0009
Percentile
0,3th
Updated

EPSS Score Trend (Last 90 Days)

668

Exposure of Resource to Wrong Sphere

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Other
Potential Impacts:
Read Application Data Modify Application Data Varies By Context
Applicable Platforms
All platforms may be affected
View CWE Details
Application

Airflow by Apache

Product Information
Vendor Apache
Product Airflow
Version Range Affected
To 2.8.0 (exclusive)
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/apache/airflow/pull/34366
Patch
https://github.com/apache/airflow/pull/34366
https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ft…
Mailing List Third Party Advisory
https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3
http://www.openwall.com/lists/oss-security/2023/12/21/1
Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/21/1
https://github.com/apache/airflow/pull/34366
Patch
https://github.com/apache/airflow/pull/34366
https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ft…
Mailing List Third Party Advisory
https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3
http://www.openwall.com/lists/oss-security/2023/12/21/1
Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/21/1