CVE-2023-22886CWE-20

Apache Airflow JDBC Provider: RCE Vulnerability

High · published June 29, 2023

CVSS v3.1
8.8
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider.

Airflow JDBC Provider Connection’s [Connection URL] parameters had no

restrictions, which made it possible to implement RCE attacks via

different type JDBC drivers, obtain airflow server permission.

This issue affects Apache Airflow JDBC Provider: before 4.0.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01518 · 74.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-06-29T09:41Z
EPSS history
Timeline
  • 29 JUN 09:41Z
    Apache Airflow JDBC Provider: RCE Vulnerability
    cvelistv5