CVE-2022-38362
Docker Provider <3.0 RCE vulnerability in example dag
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.
El Proveedor de Apache Airflow Docker versiones anteriores a 3.0.0, incluía un ejemplo de DAG que era vulnerable a una explotación remota (autenticada) de código en el host del trabajador de Airflow.
*Credits:
Thanks to Kai Zhao of 3H Secruity Team for reporting this
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-08-15 CVE Reserved
- 2022-08-16 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2022/08/16/1 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb | 2022-08-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Apache-airflow-providers-docker Search vendor "Apache" for product "Apache-airflow-providers-docker" | < 3.0.0 Search vendor "Apache" for product "Apache-airflow-providers-docker" and version " < 3.0.0" | - |
Affected
| ||||||