CVE-2023-40272CWE-20

Apache Airflow Spark Provider Arbitrary File Read via JDBC

High · published August 17, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
81.9
In the wild
Unconfirmed
What it is

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server.

It is recommended to upgrade to a version that is not affected.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02144 · 81.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-08-17T13:52Z
EPSS history
Timeline
  • 17 AUG 13:52Z
    Apache Airflow Spark Provider Arbitrary File Read via JDBC
    cvelistv5