Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/32309 | Patch |
| https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d | Mailing List Patch Vendor Advisory |
| https://github.com/apache/airflow/pull/32309 | Patch |
| https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d | Mailing List Patch Vendor Advisory |
Configurations
History
21 Nov 2024, 07:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/apache/airflow/pull/32309 - Patch | |
| References | () https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d - Mailing List, Patch, Vendor Advisory |
20 Jul 2023, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache airflow
Apache |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | |
| References | (MISC) https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d - Mailing List, Patch, Vendor Advisory | |
| References | (MISC) https://github.com/apache/airflow/pull/32309 - Patch |
12 Jul 2023, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-12 10:15
Updated : 2024-11-21 07:30
NVD link : CVE-2022-46651
Mitre link : CVE-2022-46651
CVE.ORG link : CVE-2022-46651
JSON object : View
Products Affected
apache
- airflow
CWE