CVE-2023-40611CWE-863

Apache Airflow Dag Runs Broken Access Control Vulnerability

Medium · published September 12, 2023

CVSS v3.1
4.3
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01741 · 77.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-09-12T11:05Z
EPSS history
Timeline
  • 12 SEP 11:05Z
    Apache Airflow Dag Runs Broken Access Control Vulnerability
    cvelistv5