CVE-2022-24288 Apache Airflow: RCE in example DAGs

2022-02-2508:30:16

CWE-78

apache

www.cve.org

apache airflow

rce

vulnerability

os command injection

example dags

AI Score

9.2

Confidence

High

EPSS

0.949

Percentile

99.3%

JSON

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

CNA Affected

[
  {
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.2.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]