CVE-2023-48291

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.

This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2

Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 2.8.0

References

http://www.openwall.com/lists/oss-security/2023/12/21/1Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/34366Patch
https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/12/21/1Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/34366Patch
https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3Mailing List, Third Party Advisory

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-482928.8The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a CVE-2023-482938.8The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery v CVE-2023-482944.3LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and oper CVE-2023-482955.4LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and oper CVE-2023-482964.3OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite navigation items are returned to sto CVE-2023-482977.5Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which CVE-2023-482987.5ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This v CVE-2023-482995.3TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the m CVE-2023-48309.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. T CVE-2023-483005.4The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting CVE-2023-483015.4Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.1 CVE-2023-483025.4Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.1