Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-50783
CVE-2023-50783:
Apache Airflow vulnerability analysis and mitigation
Overview
CVE-2023-50783 affects Apache Airflow versions before 2.8.0. The vulnerability was discovered and disclosed on December 21, 2023, with a severity rating of MEDIUM (CVSS 3.1 Base Score: 6.5). The vulnerability allows an authenticated user without variable edit permission to update variables, compromising the integrity of variable management in Apache Airflow (NVD, OSS Security).
Technical details
The vulnerability is classified as an Improper Access Control (CWE-284) issue that specifically affects the 'varimport' endpoint. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, required low privileges, no user interaction, and high impact on integrity with no impact on confidentiality or availability (NVD).
Impact
The vulnerability allows unauthorized data modification through variable management. An authenticated user who doesn't have explicit variable edit permissions can still update variables, potentially compromising the integrity of the system's variable management (OSS Security).
Mitigation and workarounds
Users are recommended to upgrade to Apache Airflow version 2.8.0, which contains the fix for this vulnerability. The issue was patched through a pull request that implements proper access control mechanisms for variable imports (OSS Security, GitHub PR).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management