CVE-2022-40604

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= unspecified, < 2.4.0; >= 2.3.0, < unspecified

References

https://github.com/apache/airflow/pull/26337Patch, Third Party Advisory
https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687tVendor Advisory
https://github.com/apache/airflow/pull/26337Patch, Third Party Advisory
https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687tVendor Advisory

Timeline

Published: Sep 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-406056.1MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th CVE-2022-406066.1MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th CVE-2022-406076.8IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and d CVE-2022-406087.5IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by man CVE-2022-406099.8IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an un CVE-2022-40617.5The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing un CVE-2022-406159.8IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted S CVE-2022-406168.1IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or pe CVE-2022-406177.5strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and i CVE-2022-406197.7FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affe CVE-2022-40627.8A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker g CVE-2022-406207.7FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when down