CVE-2021-45230

MEDIUM6.5EPSS 1.8%

Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver

發布日:2022/1/28修改日:2025/5/20

也稱為:GHSA-4jh2-3c85-q67hBIT-airflow-2021-45230PYSEC-2022-11

描述

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

受影響套件(3)

Bitnami/airflow>= 2.0.0, < 2.2.0
PyPI/apache-airflowfrom 0, < 2.2.0
PyPI/apache-airflow>= 1.10.0, < 2.0.0b1, >= 2.0.0, < 2.2.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

參考連結(4)

ADVISORYhttps://github.com/advisories/GHSA-4jh2-3c85-q67h
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-45230
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-11.yaml
WEBhttps://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl