CVE-2024-28746

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.

Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-287479.8An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.CVE-2024-287487.2A remote attacker with high privileges may use a reading file function to inject OS commands.CVE-2024-287497.2A remote attacker with high privileges may use a writing file function to inject OS commands.CVE-2024-287507.2A remote attacker with high privileges may use a deleting file function to inject OS commands.CVE-2024-287519.1An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.CVE-2024-287529.3A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF CVE-2024-287536.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.CVE-2024-287547.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.CVE-2024-287556.5An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum CVE-2024-287565.9The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (Mi CVE-2024-287577.5libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityP CVE-2024-287594.3A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.