CVE-2022-24288CWE-78

Apache Airflow: RCE in example DAGs

published February 25, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.

CVSS

—

EPSS

78%

Percentile

99.6

In the wild

Unconfirmed

What it is

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.77880 · 99.6th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2022-02-25T08:30Z

EPSS history

Timeline

25 FEB 08:30Z
Apache Airflow: RCE in example DAGs
cvelistv5