GitHub Advisoryadvisory · PyPI

GHSA-wpg8-mf6h-gm92 Apache Airflow Incorrect Authorization vulnerability

MEDIUM Published 2023-09-12 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-40611
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2023-09-12

Affected packages

• PyPI apache-airflow: < 2.7.1 → fixed in 2.7.1

Description

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

Related

Alias · CVE (1)

  • CVE-2023-40611 Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References