Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-22884

Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Airflow

Default version status: unaffected

  • 0 to < 2.5.1affected

Apache Software Foundation Apache Airflow MySQL Provider

Default version status: unaffected

  • 0 to < 4.0.0affected

References