Homepage
About Snyk

Incorrect Default Permissions Affecting apache-airflow package, versions [,2.8.2rc1)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Mature
    EPSS
    0.05% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-APACHEAIRFLOW-6356269
  • published 3 Mar 2024
  • disclosed 1 Mar 2024
  • credit Yusuf AYDIN
Report a new vulnerability Found a mistake?

Introduced: 1 Mar 2024

CVE-2024-26280 Open this link in a new tab
CWE-276 Open this link in a new tab

How to fix?

Upgrade apache-airflow to version 2.8.2rc1 or higher.

Overview

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Default Permissions that allow Ops and Viewers users to view all information in audit logs, including DAG names and usernames they are not permitted to view.

CVSS Scores

version 3.1
Expand this section

Snyk

4.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None