Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes
Moderate severity
GitHub Reviewed
Published
Nov 12, 2023
to the GitHub Advisory Database
•
Updated Mar 6, 2024
Description
Published by the National Vulnerability Database
Nov 12, 2023
Published to the GitHub Advisory Database
Nov 12, 2023
Reviewed
Nov 13, 2023
Last updated
Mar 6, 2024
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.
References