CVE-2023-42663

EUVD-2023-0020
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
Affected Products (NVD)
VendorProductVersion
apacheairflow
𝑥
< 2.7.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2023/11/12/2
https://github.com/apache/airflow/pull/34315
https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9
http://www.openwall.com/lists/oss-security/2023/11/12/2
https://github.com/apache/airflow/pull/34315
https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9