Skip to main content

Airflow CVE-2023-22884

CRITICAL
Command Injection (CWE-77)
2023-01-21 security@apache.org
Apache Command Injection Airflow Apache Airflow Providers Mysql
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jan 21, 2023 - 14:15 nvd
CRITICAL 9.8

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 pypi packages depend on apache-airflow (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.5.1.

DescriptionNVD

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

AnalysisAI

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.5.1; Apache Airflow MySQL Provider: before 4.0.0. Affected products include: Apache Airflow, Apache Apache-Airflow-Providers-Mysql. Version information: before 2.5.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.

More in Airflow

View all
CVE-2020-13927 CRITICAL POC
9.8 Nov 10

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
CVE-2020-11978 HIGH POC
8.8 Jul 17

An issue was found in Apache Airflow versions 1.10.10 and below. Rated high severity (CVSS 8.8), this vulnerability is r
CVE-2021-38540 CRITICAL POC
9.8 Sep 09

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. Rated critical severity (CV
CVE-2020-11981 CRITICAL POC
9.8 Jul 17

An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2022-40127 HIGH POC
8.8 Nov 14

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arb
CVE-2022-24288 HIGH POC
8.8 Feb 25

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them
CVE-2020-17526 HIGH POC
7.7 Dec 21

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a maliciou
CVE-2023-25754 CRITICAL
9.8 May 08

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.6.0. Rated critical severit
CVE-2022-40189 CRITICAL
9.8 Nov 22

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl
CVE-2022-38649 CRITICAL
9.8 Nov 22

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl
CVE-2022-38054 CRITICAL
9.8 Sep 02

In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixa
CVE-2020-11982 CRITICAL
9.8 Jul 17

An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8
CVE-2025-10035 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2023-22884 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy