CVE-2023-45348 Apache Airflow: Configuration information leakage vulnerability

2023-10-1409:46:44

CWE-200

apache

github.com

apache airflow

vulnerability

configuration info

leakage

versions 2.7.0

2.7.1

authenticated user

sensitive configuration

expose_config

non-sensitive-only

upgrade

AI Score

6.1

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the “expose_config” option is set to “non-sensitive-only”. The expose_config option is False by default.
It is recommended to upgrade to a version that is not affected.