CVE-2023-35005

Apache Airflow: Information disclosure on configuration view

EPSS 1.5%CWE-200

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

19 jun 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

Produtos afetados

Apache Software Foundation · Apache Airflow

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/apache/airflow/pull/31788 https://github.com/apache/airflow/pull/31820 https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd