GitHub Advisoryadvisory · PyPI

GHSA-32wr-qqw6-5mfp Apache Airflow vulnerable to sensitive information exposure

MEDIUM Published 2023-10-14 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-42663
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-10-17

Affected packages

• PyPI apache-airflow: < 2.7.2 → fixed in 2.7.2

Description

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user with access to read specific DAGs _only_ to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

Related

Alias · CVE (1)

  • CVE-2023-42663 Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References