CVE-2022-40127 Apache Airflow <2.4.0 has an RCE in a bash example

2022-11-1400:00:00

CWE-94

apache

www.cve.org

cve-2022-40127

apache airflow

example dags

rce

ui access

9.1 High

AI Score

Confidence

High

0.371 Low

EPSS

Percentile

97.2%

JSON

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Airflow",
    "versions": [
      {
        "version": "Apache Airflow",
        "status": "affected",
        "lessThan": "2.4.0",
        "versionType": "custom"
      }
    ]
  }
]