CVE-2023-47037CWE-863

Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

published November 12, 2023

CVSS
—
EPSS
1%
Percentile
74.0
In the wild
Unconfirmed
What it is

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01497 · 74.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-11-12T13:12Z
EPSS history
Timeline
  • 12 NOV 13:12Z
    Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)
    cvelistv5