Skip to main content

Missing Authorization

CVE-2024-27906

Medium
5.9/10

Summary

In apache-airflow package versions prior to 2.8.2rc2, it has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs, for which they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to a fixed version or newer to mitigate the risk associated with this vulnerability.

  • LOW
  • LOCAL
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published