Apache Airflow Information Disclosure Vulnerability (CNVD-2023-72235)

Apache Airflow is the United States Apache (Apache) Foundation’s set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to 2.7.1, which stems from allowing a user with the right to view tasks/dags in the UI to create URLs, which could lead to the disclosure of a task’s configuration. An attacker can exploit this vulnerability to obtain sensitive information.