CVE-2023-50944CWE-862

Apache Airflow: Bypass permission verification to read code of other dags

Medium · published January 24, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00979 · 61.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-01-24T12:58Z
EPSS history
Timeline
  • 24 JAN 12:58Z
    Apache Airflow: Bypass permission verification to read code of other dags
    cvelistv5