CVE-2022-40127
Assigner: apache
Published: 2022-11-14T00:00:00
State: PUBLISHED
title: Apache Airflow <2.4.0 has an RCE in a bash example
descriptions: value: A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
affected: vendor: Apache Software Foundation
product: Apache Airflow
versions: version: Apache Airflow
status: affected
lessThan: 2.4.0
versionType: custom
credits: value: Apache Airflow PMC would like to thank L3yx of Syclover Security Team.
metrics: other: type: unknown
content: other: low
problemTypes: descriptions: type: CWE
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
cweId: CWE-94
x_generator: engine: Vulnogram 0.0.9
source: discovery: UNKNOWN
workarounds: value: Do not enable example dags on systems that should not allow UI user to execute an arbitrary command.