PYSEC-2024-245

vendorUSosv

view advisory published 2024-02-29Licence: CC-BY-4.0

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-27906US	—OT elevated	0.34% (28th)	—	2024-02-29
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through th…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2024/02/29/1ARTICLE
https://github.com/advisories/GHSA-6v6w-h8m6-7mv2ADVISORY
https://github.com/apache/airflow/pull/37290WEB
https://github.com/apache/airflow/pull/37468REPORT
https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5ARTICLE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan