CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2023-50783
Medium (6.5) in apache airflow. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in apache-airflow 2.8.0.
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.
This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.
Users are recommended to upgrade to 2.8.0, which fixes this issue
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-11-01)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:airflow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5938-79hg-xh3q | PyPI | apache-airflow | <2.8.0 | 2.8.0 |
| PYSEC-2023-267 | PyPI | apache-airflow | <2.8.0 | 2.8.0 |