Airflow CVE-2023-25754

CRITICAL

Privilege Context Switching Error (CWE-270)

2023-05-08 security@apache.org

Apache Information Disclosure Airflow

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

May 08, 2023 - 12:15 nvd

CRITICAL 9.8

DescriptionNVD

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.

AnalysisAI

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.6.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-270. Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.6.0. Affected products include: Apache Airflow. Version information: before 2.6.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Airflow

View all

CVE-2020-13927 CRITICAL Emergency POC

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

CVE-2020-11978 HIGH Act Now POC

An issue was found in Apache Airflow versions 1.10.10 and below. Rated high severity (CVSS 8.8), this vulnerability is r

CVE-2021-38540 CRITICAL Act Now POC

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. Rated critical severity (CV

CVE-2020-11981 CRITICAL Act Now POC

An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2022-40127 HIGH This Week POC

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arb

CVE-2022-24288 HIGH This Week POC

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them

CVE-2020-17526 HIGH This Week POC

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a maliciou

CVE-2023-22884 CRITICAL Act Now

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Fou

CVE-2022-40189 CRITICAL Act Now

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl

CVE-2022-38649 CRITICAL Act Now

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl

CVE-2022-38054 CRITICAL Act Now

In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixa

CVE-2020-11982 CRITICAL Act Now

An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability

Same weakness CWE-270 – Privilege Context Switching Error

View all

CVE-2021-3493 HIGH POC

CVE-2023-37912 HIGH POC

CVE-2024-12570 MEDIUM POC

CVE-2024-36513 HIGH

CVE-2024-8641 HIGH

CVE-2024-11263 HIGH

CVE-2024-46975 HIGH

CVE-2026-34853 HIGH

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2023-25754 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy