CVE-2022-27949

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= unspecified, < 2.3.1

References

http://www.openwall.com/lists/oss-security/2022/11/14/3Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/22754Patch, Third Party Advisory
https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65pMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/11/14/3Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/22754Patch, Third Party Advisory
https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65pMailing List, Vendor Advisory

Timeline

Published: Nov 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27955.3By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effective CVE-2022-279505.5In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.CVE-2022-279529.8An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a craf CVE-2022-279585.4Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitra CVE-2022-27964.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.CVE-2022-279605.4Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitraril CVE-2022-279615.4A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML CVE-2022-279629.8Bluecms 1.6 has a SQL injection vulnerability at cooike.CVE-2022-279636.5Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.CVE-2022-279646.5Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file CVE-2022-279656.5Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.CVE-2022-279666.5Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.