CVE-2023-35798CWE-20

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

published June 27, 2023

CVSS
—
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01263 · 69.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-06-27T11:39Z
EPSS history
Timeline
  • 27 JUN 11:39Z
    Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability
    cvelistv5