AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowGHSA-4jh2-3c85-q67h

Improper Privilege Management in apache-airflow

Apache Airflow

CVE-2021-45230 · Published Jan 28, 2022 · updated Sep 3, 2024

Medium6.5
Fix: upgrade to 2.2.0 or later
GitHub advisory

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 2.2.02.2.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-269
Also known as
BIT-airflow-2021-45230, CVE-2021-45230, PYSEC-2022-11

More Apache Airflow advisories

All Apache Airflow
Medium 4.7Sep 3, 2022Apache Airflow exposes arbitrary file contentCVE-2022-38170fixed in 2.3.4Critical 9.8May 24, 2022Missing Authentication for Critical Function in Apache AirflowCVE-2021-38540fixed in 2.1.3Medium 6.1May 14, 2022Apache Airflow Reflected Cross-site Scripting vulnerability in 404 EndpointCVE-2017-12614fixed in 1.9.0Medium 6.1Feb 26, 2022Apache Airflow Cross-site Scripting VulnerabilityCVE-2021-45229fixed in 2.2.4rc1High 8.8Feb 26, 2022OS Command injection in Apache AirflowCVE-2022-24288fixed in 2.2.4Medium 5.3Aug 30, 2021Missing Authorization in Apache AirflowCVE-2021-35936fixed in 2.1.2