CVE-2023-42781
Assigner: apache
Published: 2023-11-12T13:14:09.700Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Airflow
vendor: Apache Software Foundation
versions: lessThan: 2.7.3
status: affected
version: 0
versionType: semver
credits: type: finder
value: balis0ng
type: remediation developer
value: Hussein Awala
descriptions: supportingMedia: base64: no
type: text/html
value: Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.&nbsp; This is a different issue than CVE-2023-42663 but leading to similar outcome.<br>Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
value: Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.  This is a different issue than CVE-2023-42663 but leading to similar outcome.
Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: discovery: UNKNOWN
title: Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
x_generator: engine: Vulnogram 0.1.0-dev