CVE-2023-45348CWE-200

Apache Airflow: Configuration information leakage vulnerability

published October 14, 2023

CVSS
—
EPSS
2%
Percentile
75.6
In the wild
Unconfirmed
What it is

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default.

It is recommended to upgrade to a version that is not affected.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01600 · 75.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-10-14T09:46Z
EPSS history
Timeline
  • 14 OCT 09:46Z
    Apache Airflow: Configuration information leakage vulnerability
    cvelistv5