CVE-2023-40611
Apache Airflow Dag Runs Broken Access Control Vulnerability
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.3EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
12 Sep 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.
Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Apache Software Foundation · Apache AirflowWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →