GHSA-5938-79hg-xh3q

Apache Airflow Improper Access Control vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-50783

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 2.8.0	2.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-50783 advisory
https://github.com/apache/airflow/pull/33932 web
https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929 web
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-267.yaml web
https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn web
http://www.openwall.com/lists/oss-security/2023/12/21/4 web