CVE-2023-46288: 
Apache Airflow vulnerability analysis and mitigation

CVE-2023-46288 is a sensitive information exposure vulnerability affecting Apache Airflow versions 2.4.0 to 2.7.0. The vulnerability allows authenticated users to access sensitive configuration information through the Airflow REST API, even when the exposeconfig option is set to non-sensitive-only. The exposeconfig option is False by default (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. It is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue specifically affects the API configuration endpoint, allowing authenticated users to bypass the intended restrictions of the non-sensitive-only configuration setting (NVD).

When exploited, this vulnerability allows authenticated users to access sensitive configuration information that should be restricted, potentially exposing sensitive system details or credentials through the Airflow REST API (NVD).

Users are recommended to upgrade to Apache Airflow version 2.7.2, which fixes this issue along with CVE-2023-45348. If immediate upgrade is not possible, users can set the expose_config option to False as a workaround (NVD).