CVE-2023-35797

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.

Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details.

It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow Apache Hive Provider	< 6.1.1
apache	apache-airflow-providers-apache-hive	< 6.1.1

References

http://www.openwall.com/lists/oss-security/2023/07/12/3
https://github.com/apache/airflow/pull/31983Patch
https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1yMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/07/12/3
https://github.com/apache/airflow/pull/31983Patch
https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1yMailing List, Vendor Advisory

Timeline

Published: Jul 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-357984.3Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL P CVE-2023-357995.5Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to CVE-2023-35804.3Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.CVE-2023-358004.3Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that CVE-2023-358018.1A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a netwo CVE-2023-358029.8IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploit CVE-2023-358039.8IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.CVE-2023-358088.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been iden CVE-2023-358098.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified i CVE-2023-35818.1Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket AP CVE-2023-358107.2An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has b CVE-2023-358118.8An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the R