CVE-2022-24288
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Published
2022-02-25T09:15:06.957
Last Modified
2024-11-21T06:50:05.807
Status
Modified
Source
[email protected]
Severity
CVSSv3.1: 8.8 (HIGH)
CVSSv2 Vector
AV:N/AC:L/Au:S/C:P/I:P/A:P
- Access Vector: NETWORK
- Access Complexity: LOW
- Authentication: SINGLE
- Confidentiality Impact: PARTIAL
- Integrity Impact: PARTIAL
- Availability Impact: PARTIAL
Exploitability Score
8.0
Impact Score
6.4
Weaknesses
-
Type: Secondary
CWE-78
-
Type: Primary
CWE-78
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
apache
|
airflow
|
< 2.2.4 |
Yes
|
References