CVE-2022-24288: vulnerability in Apache Airflow
Apache Airflow: RCE in example DAGs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
62Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 78%
from disclosure to weapon
Published on NVDFeb 25
VulnCheck+651d
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Affected products
Apache Software Foundation · Apache AirflowRelated CVEs — Apache Airflow
In the same product, most dangerous first.
CVE-2020-11978HIGHCVE-2020-11978EPSS 99.2%KEVCVE-2022-40127HIGHApache Airflow <2.4.0 has an RCE in a bash exampleEPSS 85.7%CVE-2022-45402MEDIUMApache Airflow: Open redirect during loginEPSS 81.1%CVE-2021-38540—Apache Airflow: Variable Import endpoint missed authentication checkEPSS 80.9%CVE-2020-11981—CVE-2020-11981EPSS 36.8%CVE-2020-17526—CVE-2020-17526EPSS 23.9%