CVE-2023-45348

Medium

Description

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Apache Airflow

PublishedOct 14, 2023

First seenOct 14, 2023

Weakness typeCWE-200Sensitive information exposure

How to fix

Update

apache airflow2.7.2 or later
apache-airflow2.7.2 or later

Patches

github.com/apache/airflow/pull/34712

Vendor advisories

lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9

Affected products

Product	Affected versions	Fixed in
apache airflow	2.7.0 ≤ v < 2.7.2	2.7.2
apache-airflowPyPI	2.7.0 ≤ v < 2.7.2	2.7.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.