CVE-2023-47037: Airflow Broken Access Control Vulnerability

Disclosed: 2023-11-29 23:13:22 By 0xt4req To ibb
Low
Vulnerability Details
Hi IBB, Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Here is the conversation between the security team of airflow. █████ More Details: https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 ## Impact Broken Access Control Vulnerability.
Actions
View on HackerOne
Report Stats
  • Report ID: 2249299
  • State: Closed
  • Substate: resolved
  • Upvotes: 21
Share this report