CVE-2023-35005

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35005
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/airflow/pull/31788 Patch
https://github.com/apache/airflow/pull/31820 Issue Tracking
https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd Mailing List Vendor Advisory
https://github.com/apache/airflow/pull/31788 Patch
https://github.com/apache/airflow/pull/31820 Issue Tracking
https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:07

Type Values Removed Values Added
References () https://github.com/apache/airflow/pull/31788 - Patch () https://github.com/apache/airflow/pull/31788 - Patch
References () https://github.com/apache/airflow/pull/31820 - Issue Tracking () https://github.com/apache/airflow/pull/31820 - Issue Tracking
References () https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd - Mailing List, Vendor Advisory () https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd - Mailing List, Vendor Advisory

27 Jun 2023, 09:02

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-200 NVD-CWE-noinfo
CPE cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
References (MISC) https://github.com/apache/airflow/pull/31788 - (MISC) https://github.com/apache/airflow/pull/31788 - Patch
References (MISC) https://github.com/apache/airflow/pull/31820 - (MISC) https://github.com/apache/airflow/pull/31820 - Issue Tracking
References (MISC) https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd - (MISC) https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd - Mailing List, Vendor Advisory
First Time Apache airflow
Apache

19 Jun 2023, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-19 09:15

Updated : 2024-11-21 08:07

NVD link : CVE-2023-35005

Mitre link : CVE-2023-35005

CVE.ORG link : CVE-2023-35005

JSON object : View

Products Affected

apache

  • airflow
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo