CVE-2023-28710

CWE-20 — Improper Input Validation5 documents5 sources
Severity
7.5HIGH
EPSS
1.1%
top 21.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Airflow Spark ProviderApache Apache-airflow-providers-apache-spark
Timeline
PublishedApr 7
Latest updateJul 12

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

🔴Vulnerability Details

3
CVEList
Apache Airflow Spark Provider Arbitrary File Read via JDBC↗2023-04-07
▶
OSV
Apache Airflow Spark Provider vulnerable to improper input validation↗2023-04-07
▶
GHSA
Apache Airflow Spark Provider vulnerable to improper input validation↗2023-04-07
▶

💬Community

1
HackerOne
CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBC↗2023-07-12
▶
CVE-2023-28710 (HIGH CVSS 7.5) | Improper Input Validation vulnerabi | cvebase.io