CVE-2023-39508

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

CVE-2023-39508 Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

CVE-2023-39508 Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

CVE-2023-39508

The CVE-2023-39508 issue affects Apache Airflow prior to 2.6.0, where the Run Task feature could be exploited by an authenticated user to execute code in the webserver context and bypass DAG access restrictions, exposing sensitive information and potentially impacting confidentiality, integrity, ...

CVE-2023-39508: Execution with Unnecessary Privileges

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

Apache Airflow Security Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. Apache Airflow versions prior to 2.6.0 have a security vulnerability that stems from a...

The vulnerability of the Apache Airflow network software, the CNCF Kubernetes Provider, allows a hacker to execute arbitrary code.

The vulnerability of the Apache Airflow network software component, specifically the CNCF Kubernetes Provider, is related to deficiencies in the process of eliminating special elements from output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Exploit for Command Injection in Apache Airflow

Apache Airflow SQL injection PoC CVE-2023-22884 PoC for C...

Exploit for Command Injection in Apache Airflow

Apache Airflow SQL injection PoC CVE-2023-22884 PoC for C...

Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Internet Bug Bounty: Apache Airflow path traversal by authenticated user

Apache Airflow before version 2.6.3 was affected by a vulnerability that allowed an authenticated user to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter...

Improper Input Validation

Apache Airflow Apache Hive Provider is vulnerable to Improper Input Validation vulnerability. The vulnerability is due to not validating/sanitising proxyuser option and allowing injection of a semicolon while connecting to Apche Hive using Hive CLI Connection. This can result in bypassing securit...

Regular Expression Denial Of Service (ReDoS)

apacheairflow is vulnerable to Regular expression Denial of Service ReDoS. The vulnerability exists in the partialsubset function at dag.py due to not validating user input regex efficiently which allows an attacker to send a crafted input causing an application crash...

Apache Airflow Input Validation Error Vulnerability (CNVD-2023-67074)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow versions prior to...

Apache Airflow Path Traversal Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A path traversal vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-67075)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

Apache Airflow Security Bypass Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Information Disclosure

apacheairflow is vulnerable to Information Disclosure. A remote authenticated attacker with the ability to update the connection resource is able to gain access to confidential information in theConnection edit view, resulting in disclosure of sensitive information...

GHSA-4Q2Q-Q5PW-2342 Apache Airflow Apache Hive Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxyuser option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updatin...