Veracode Vulnerability DatabaseVERACODE:43832Information Disclosure
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
16.0%
Apache Airflow is vulnerable to Information Disclosure. The vulnerability is due to a flaw that permits authenticated users to list warnings for all Directed Acyclic Graphs (DAG’s) regardless of their permissions to access such DAG’s. This leads to exposure of sensitive information such as dag_ids and the stack-traces.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache-airflow | le | 2.7.1 | |
| apache-airflow | le | 2.7.1 |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
16.0%