CVE-2023-50783CWE-284

Apache Airflow: Improper access control vulnerability on the "varimport" endpoint

published December 21, 2023

CVSS
—
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.

This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.

Users are recommended to upgrade to 2.8.0, which fixes this issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01390 · 72.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-12-21T09:28Z
EPSS history
Timeline
  • 21 DEC 09:28Z
    Apache Airflow: Improper access control vulnerability on the "varimport" endpoint
    cvelistv5