Lucene search

CVE-2023-22884

🗓️ 21 Jan 2023 14:10:15Reported by apacheType

cve🔗 web.nvd.nist.gov👁 71 Views🌐 WEB

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider

Reporter	Title	Published	Views	Family All 10
OSV	CVE-2023-22884	21 Jan 202314:15	–	osv
OSV	Command Injection in Apache Airflow and Apache Airflow MySQL Provider	21 Jan 202315:30	–	osv
OSV	BIT-airflow-2023-22884	6 Mar 202410:55	–	osv
GithubExploit	Exploit for Command Injection in Apache Airflow	29 Jul 202309:26	–	githubexploit
GithubExploit	Exploit for Command Injection in Apache Airflow	29 Jul 202309:26	–	githubexploit
Cvelist	CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow	21 Jan 202313:02	–	cvelist
Github Security Blog	Command Injection in Apache Airflow and Apache Airflow MySQL Provider	21 Jan 202315:30	–	github
Prion	Command injection	21 Jan 202314:15	–	prion
Veracode	Command Injection	25 Jan 202305:48	–	veracode
NVD	CVE-2023-22884	21 Jan 202314:15	–	nvd

Nvd

Vulners

Node

apache airflowRange<2.5.1

apache apache-airflow-providers-mysqlRange<4.0.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.5.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Apache Airflow MySQL Provider",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.0.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/apache/airflow/pull/28811
lists	www.lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h

Parameter	Position	Path	Description	CWE
bulk_load_from_file	path	/dags	Vulnerability allowing command injection through improper input sanitization in Apache Airflow's MySQL provider.	CWE-77
--host	request body	/exploit.py	Command injection vulnerability in exploit script for Apache Airflow allowing attackers to execute arbitrary commands.	CWE-77
--mode	request body	/exploit.py	Command injection vulnerability in exploit script for Apache Airflow allowing attackers to execute arbitrary commands.	CWE-77
--ci	request body	/exploit.py	Command injection vulnerability in exploit script for Apache Airflow allowing attackers to execute arbitrary commands.	CWE-77
--di	request body	/exploit.py	Command injection vulnerability in exploit script for Apache Airflow allowing attackers to execute arbitrary commands.	CWE-77
-u	request body	/exploit.py	Command injection vulnerability in exploit script for Apache Airflow allowing attackers to execute arbitrary commands.	CWE-77
-p	request body	/exploit.py	Command injection vulnerability in exploit script for Apache Airflow allowing attackers to execute arbitrary commands.	CWE-77

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

21 Jan 2023 14:15Current

9.5High risk

Vulners AI Score9.5

CVSS39.8

EPSS0.00783

CWE-77