CVE-2023-50783

EUVD-2023-0035
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.
This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.
Users are recommended to upgrade to 2.8.0, which fixes this issue
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Affected Products (NVD)
VendorProductVersion
apacheairflow
𝑥
< 2.8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2023/12/21/4
https://github.com/apache/airflow/pull/33932
https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn
http://www.openwall.com/lists/oss-security/2023/12/21/4
https://github.com/apache/airflow/pull/33932
https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn