CVE-2023-50944
Assigner: apache
Published: 2024-01-24T12:58:18.873Z
State: PUBLISHED
affected: collectionURL: https://pypi.python.org
defaultStatus: unaffected
packageName: apache-airflow
product: Apache Airflow
vendor: Apache Software Foundation
versions: lessThan: 2.8.1
status: affected
version: 0
versionType: semver
credits: type: finder
value: Timon8 Zhang
descriptions: supportingMedia: base64: no
type: text/html
value: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access.&nbsp;This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.<br>
value: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
source: discovery: UNKNOWN
title: Apache Airflow: Bypass permission verification to read code of other dags
x_generator: engine: Vulnogram 0.1.0-dev