CVE-2023-47037

2023-11-1214:15:25

CWE-863

apache

web.nvd.nist.gov

apache airflow

vulnerability

authenticated users

dag run details

upgrade

cve-2023-47037

nvd

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.2

Confidence

High

EPSS

0.001

Percentile

48.8%

JSON

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Affected configurations

Nvd

Vulners

Node

apacheairflowRange<2.7.3

VendorProductVersionCPE
apacheairflow*cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	airflow	*	cpe:2.3:a:apache:airflow::::::::

CNA Affected

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.7.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]