CVE-2024-28746 Apache Airflow: Ignored Airflow Permissions

2024-03-1408:41:03

CWE-281

apache

www.cve.org

apache airflow

vulnerability

ignored permissions

upgrade

2.8.3

AI Score

6.4

Confidence

Low

EPSS

Percentile

15.5%

JSON

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.

Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

CNA Affected

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.8.3",
        "status": "affected",
        "version": "2.8.0",
        "versionType": "semver"
      }
    ]
  }
]