CVE-2022-40127CWE-94

Apache Airflow <2.4.0 has an RCE in a bash example

High · published November 14, 2022

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.7th percentile for exploit probability.

CVSS v3.1

8.8

EPSS

86%

Percentile

99.7

In the wild

Unconfirmed

What it is

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.85653 · 99.7th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2022-11-14T00:00Z

EPSS history

Timeline

14 NOV 00:00Z
Apache Airflow <2.4.0 has an RCE in a bash example
cvelistv5