CVE-2023-37415

CWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGH
EPSS
0.4%
top 39.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Airflow Apache Hive ProviderApache Apache-airflow-providers-apache-hive
Timeline
PublishedJul 13

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

3
CVEList
Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user↗2023-07-13
▶
GHSA
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability↗2023-07-13
▶
OSV
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability↗2023-07-13
▶
CVE-2023-37415 (HIGH CVSS 8.8) | Improper Input Validation vulnerabi | cvebase.io