// For flags

CVE-2023-47037

Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. 

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. 

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

No pudimos aplicar CVE-2023-40611 en 2.7.1 y esta vulnerabilidad se marcó como solucionada en ese momento. Apache Airflow, versiones anteriores a 2.7.3, se ve afectada por una vulnerabilidad que permite a los usuarios autenticados y autorizados para ver DAG modificar algunos valores de detalles de ejecución de DAG al enviar notas. Esto podría hacer que alteren detalles como los parámetros de configuración, la fecha de inicio, etc. Los usuarios deben actualizar a la versión 2.7.3 o posterior, que ha eliminado la vulnerabilidad.

*Credits: Tareq Ahamed from Hackerone, Augusto Hidalgo
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-10-30 CVE Reserved
  • 2023-11-12 CVE Published
  • 2024-09-03 CVE Updated
  • 2024-10-12 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
Airflow
Search vendor "Apache" for product "Airflow"
< 2.7.3
Search vendor "Apache" for product "Airflow" and version " < 2.7.3"
-
Affected