CVE-2023-40611

MEDIUM4.3EPSS 0.12%

Apache Airflow Dag Runs Broken Access Control Vulnerability

發布日:2023/9/12修改日:2025/5/20

也稱為:GHSA-wpg8-mf6h-gm92BIT-airflow-2023-40611PYSEC-2023-170

描述

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

受影響套件(3)

Bitnami/airflowfrom 0, < 2.7.3
PyPI/apache-airflowfrom 0, < 2.7.1
PyPI/apache-airflowfrom 0, < 2.7.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-40611
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad
WEBhttps://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef
WEBhttps://github.com/apache/airflow/pull/33413
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-170.yaml
WEBhttps://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0
WEBhttp://www.openwall.com/lists/oss-security/2023/11/12/1