CVE-2023-47037

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/11/12/1	Mailing List Third Party Advisory
https://github.com/apache/airflow/pull/33413	Issue Tracking Patch
https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0	Mailing List
http://www.openwall.com/lists/oss-security/2023/11/12/1	Mailing List Third Party Advisory
https://github.com/apache/airflow/pull/33413	Issue Tracking Patch
https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:29

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2023/11/12/1 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2023/11/12/1 - Mailing List, Third Party Advisory
References	~~() https://github.com/apache/airflow/pull/33413 - Issue Tracking, Patch~~	() https://github.com/apache/airflow/pull/33413 - Issue Tracking, Patch
References	~~() https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 - Mailing List~~	() https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 - Mailing List

20 Nov 2023, 19:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-12 14:15

Updated : 2024-11-21 08:29

NVD link : CVE-2023-47037

Mitre link : CVE-2023-47037

CVE.ORG link : CVE-2023-47037

JSON object : View

Products Affected

apache

airflow

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-47037", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-11-12T14:15:25.980", "references": [{"url": "http://www.openwall.com/lists/oss-security/2023/11/12/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/pull/33413", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2023/11/12/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/apache/airflow/pull/33413", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "We failed to apply\u00a0CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.\u00a0\n\nApache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.\u00a0\n\nUsers should upgrade to version 2.7.3 or later which has removed the vulnerability.\n\n"}, {"lang": "es", "value": "No pudimos aplicar CVE-2023-40611 en 2.7.1 y esta vulnerabilidad se marc\u00f3 como solucionada en ese momento. Apache Airflow, versiones anteriores a 2.7.3, se ve afectada por una vulnerabilidad que permite a los usuarios autenticados y autorizados para ver DAG modificar algunos valores de detalles de ejecuci\u00f3n de DAG al enviar notas. Esto podr\u00eda hacer que alteren detalles como los par\u00e1metros de configuraci\u00f3n, la fecha de inicio, etc. Los usuarios deben actualizar a la versi\u00f3n 2.7.3 o posterior, que ha eliminado la vulnerabilidad."}], "lastModified": "2024-11-21T08:29:38.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8DE0419-3A7A-4E73-A896-096554A71E34", "versionEndExcluding": "2.7.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}