CVE-2023-47037

Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

EPSS 1.5%CWE-863

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

12 Nov 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Affected products

Apache Software Foundation · Apache Airflow

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/apache/airflow/pull/33413 https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 http://www.openwall.com/lists/oss-security/2023/11/12/1