CVE-2024-31869
Vulnerability from cvelistv5
Published
2024-04-18 07:19
Modified
2024-11-01 18:51
Severity ?
EPSS score ?
Summary
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Apache Software Foundation | Apache Airflow |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-31869", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-04-18T20:47:34.207684Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-01T18:51:09.881Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T01:59:50.558Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/apache/airflow/pull/38795" }, { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/04/17/10" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [ { "lessThanOrEqual": "2.8.4", "status": "affected", "version": "2.7.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Manmeet Rangoola" }, { "lang": "en", "type": "remediation developer", "value": "Jarek Potiuk" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003evia the \"configuration\" UI page\u0026nbsp;\u003c/span\u003ewhen \"non-sensitive-only\" was set as \"webserver.expose_config\" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your \"expose_config\" configuration to False as a workaround. This is similar, but different to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/advisories/GHSA-9qqg-mh7c-chfq\"\u003eCVE-2023-46288\u003c/a\u003e which concerned API, not UI configuration page." } ], "value": "Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the \"configuration\" UI page\u00a0when \"non-sensitive-only\" was set as \"webserver.expose_config\" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your \"expose_config\" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page." } ], "metrics": [ { "other": { "content": { "text": "low" }, "type": "Textual description of severity" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-04-18T07:19:05.033Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/apache/airflow/pull/38795" }, { "tags": [ "vendor-advisory" ], "url": "https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3" }, { "url": "http://www.openwall.com/lists/oss-security/2024/04/17/10" } ], "source": { "discovery": "UNKNOWN" }, "title": "Apache Airflow: Sensitive configuration for providers displayed when \"non-sensitive-only\" config used", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2024-31869", "datePublished": "2024-04-18T07:19:05.033Z", "dateReserved": "2024-04-06T19:52:15.124Z", "dateUpdated": "2024-11-01T18:51:09.881Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-31869\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-04-18T08:15:38.037\",\"lastModified\":\"2024-05-01T18:15:23.843\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the \\\"configuration\\\" UI page\u00a0when \\\"non-sensitive-only\\\" was set as \\\"webserver.expose_config\\\" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your \\\"expose_config\\\" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.\"},{\"lang\":\"es\",\"value\":\"Las versiones 2.7.0 a 2.8.4 de Airflow tienen una vulnerabilidad que permite a un usuario autenticado ver la configuraci\u00f3n confidencial del proveedor a trav\u00e9s de la p\u00e1gina de interfaz de usuario \\\"configuraci\u00f3n\\\" cuando se configur\u00f3 \\\"solo no confidencial\\\" como configuraci\u00f3n \\\"webserver.expose_config\\\" (el proveedor de apio es el \u00fanico proveedor comunitario actualmente que tiene configuraciones confidenciales). Deber\u00edas migrar a Airflow 2.9 o cambiar tu configuraci\u00f3n \\\"expose_config\\\" a False como workaround. Esto es similar, pero diferente a CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq, que se refer\u00eda a la API, no a la p\u00e1gina de configuraci\u00f3n de la UI.\"}],\"metrics\":{},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2024/04/17/10\",\"source\":\"security@apache.org\"},{\"url\":\"https://github.com/apache/airflow/pull/38795\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3\",\"source\":\"security@apache.org\"}]}}" } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.