CVE-2024-31869

CWE-200 — Information Exposure4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.0%
top 85.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache AirflowApache Software Foundation Apache Airflow
Timeline
PublishedApr 18

Description

Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https:/…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶NVDapache/airflow2.7.0 — 2.9.0
▶PyPIapache-airflow2.7.0 — 2.9.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used↗2024-04-18
▶
CVEList
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used↗2024-04-18
▶
GHSA
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used↗2024-04-18
▶
CVE-2024-31869 (MEDIUM CVSS 4.3) | Airflow versions 2.7.0 through 2.8. | cvebase.io