Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated
    user with limited access to some DAGs, to craft a request that could give the user write access to various
    DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they
    shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are
    strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this
    vulnerability. (CVE-2023-48291)

ID	Name	Product	Family	Type	Severity
461599	Echo: apache-airflow: security update to 2.8.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461599	Echo: apache-airflow: security update to 2.8.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
412616	SCA: security update for apache-airflow (GHSA-8f57-wcmg-4jmh)	Tenable Cloud Security	SCA Checks	Local	medium
412616	SCA: security update for apache-airflow (GHSA-8f57-wcmg-4jmh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2023-48291

medium

Tenable Plugins

medium

medium

medium

medium