CVE-2022-46651

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
Apache Software FoundationApache Airflow< 2.6.3

References

Timeline

Published
Jul 12, 2023
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-466567.8Insecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentiallyCVE-2022-466589.8The affected product is vulnerable to a stack-based buffer overflow which could lead to a denial of service or remote code execution.CVE-2022-46665.4The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes bCVE-2022-466606.5An unauthorized user could alter or write files with full control over the path and content of the file.CVE-2022-466626.7Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoteCVE-2022-466637.5In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.CVE-2022-466648.1A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4)CVE-2022-46675.4The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them bacCVE-2022-466706.1Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100CVE-2022-466755.3Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability. A unauthenticated attacker could potentiallyCVE-2022-466764.9Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disable or delete users undCVE-2022-466774.9Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroup
CVE-2022-46651: Medium severity, CVSS 6.5 | Vulnix