Vulnerabilities > CVE-2023-35005 - Unspecified vulnerability in Apache Airflow 2.5.0/2.6.0/2.6.1

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
apache
NVD
Published: 2023-06-19
Updated: 2024-11-21

Summary

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

Vulnerable Configurations

Part Description Count
Application
Apache
9

References