CVE-2024-32077

2024-05-1416:17:01

CWE-79

[email protected]

web.nvd.nist.gov

apache airflow

vulnerability

authenticated attacker

malicious data

task instance logs

upgrade

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

JSON

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.
Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Affected configurations

Vulners

Node

apacheairflowRange≤2.9.1

CNA Affected

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.9.1",
        "status": "affected",
        "version": "2.9.0",
        "versionType": "semver"
      }
    ]
  }
]