CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22888 – Apache Airflow: Scheduler remote DoS
https://notcve.org/view.php?id=CVE-2023-22888
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected • https://github.com/apache/airflow/pull/32293 https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36543 – Apache Airflow: ReDoS via dags function
https://notcve.org/view.php?id=CVE-2023-36543
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected • https://github.com/apache/airflow/pull/32060 https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46651 – Apache Airflow: Security vulnerability on AirFlow Connections
https://notcve.org/view.php?id=CVE-2022-46651
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability. • https://github.com/apache/airflow/pull/32309 https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22887 – Apache Airflow path traversal by authenticated user
https://notcve.org/view.php?id=CVE-2023-22887
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected • https://github.com/apache/airflow/pull/32293 https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35908 – Apache Airflow: Access to DAGs without relevant permission
https://notcve.org/view.php?id=CVE-2023-35908
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected • https://github.com/apache/airflow/pull/32014 https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw • CWE-863: Incorrect Authorization •