CVE-2023-35005

Apache Airflow: Information disclosure on configuration view

EPSS 1.5%CWE-200

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

19 Jun 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

Affected products

Apache Software Foundation · Apache Airflow

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/apache/airflow/pull/31788 https://github.com/apache/airflow/pull/31820 https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd