← Back

CVE-2023-47037

nvd nist
Published: Nov 12, 2023Modified: Feb 13, 2025

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.  Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.  Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Affected (1)

Products: Apache: Airflow
1 product
Airflow
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Before 2.7.3

References (6)

Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Issue TrackingPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List

Timeline

No history available yet.