CVE-2023-50944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50944
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/01/24/5 Mailing List
https://github.com/apache/airflow/pull/36257 Third Party Advisory
https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/01/24/5 Mailing List
https://github.com/apache/airflow/pull/36257 Third Party Advisory
https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
History

13 Feb 2025, 18:15

Type Values Removed Values Added
Summary (en) Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue. (en) Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

21 Nov 2024, 08:37

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/01/24/5 - Mailing List () http://www.openwall.com/lists/oss-security/2024/01/24/5 - Mailing List
References () https://github.com/apache/airflow/pull/36257 - Third Party Advisory () https://github.com/apache/airflow/pull/36257 - Third Party Advisory
References () https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - Mailing List, Vendor Advisory () https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - Mailing List, Vendor Advisory

30 Jan 2024, 22:58

Type Values Removed Values Added
First Time Apache
Apache airflow
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
References () https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - () https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - Mailing List, Vendor Advisory
References () https://github.com/apache/airflow/pull/36257 - () https://github.com/apache/airflow/pull/36257 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/01/24/5 - () http://www.openwall.com/lists/oss-security/2024/01/24/5 - Mailing List

24 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/01/24/5 -

24 Jan 2024, 13:49

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-24 13:15

Updated : 2025-06-11 17:15

NVD link : CVE-2023-50944

Mitre link : CVE-2023-50944

CVE.ORG link : CVE-2023-50944

JSON object : View

Products Affected

apache

  • airflow
CWE
CWE-862

Missing Authorization