CVE-2024-45498

CWE-1165 documents5 sources
Severity
8.8HIGH
EPSS
1.6%
top 18.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedSep 7
Latest updateDec 7

Description

Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrad…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶PyPIapache-airflow2.10.0 — 2.10.1
▶NVDapache/airflow2.10.0

🔴Vulnerability Details

3
CVEList
Apache Airflow: Command Injection in an example DAG↗2024-09-07
▶
GHSA
Apache Airflow vulnerable to Improper Encoding or Escaping of Output↗2024-09-07
▶
OSV
Apache Airflow vulnerable to Improper Encoding or Escaping of Output↗2024-09-07
▶

💬Community

1
HackerOne
CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAG↗2024-12-07
▶
CVE-2024-45498 (HIGH CVSS 8.8) | Example DAG: example_inlet_event_ex | cvebase.io