{"id":"CVE-2023-50783","published":"2023-12-21T09:28:47Z","modified":"2025-02-13T17:19:40Z","title":"Apache Airflow: Improper access control vulnerability on the \"varimport\" endpoint","vendor":"Apache","product":"Apache Airflow","tier":"tail","description":{"text":"Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.\nThis flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.\nUsers are recommended to upgrade to 2.8.0, which fixes this issue","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0139,"percentile":0.72289,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://github.com/apache/airflow/pull/33932","tags":["patch"]},{"url":"https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/21/4","tags":[]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":14.46}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":["< 2.8.0"]}],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<2.8.0"],"patched":["2.8.0"],"from":["GHSA-5938-79hg-xh3q","PYSEC-2023-267"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0035","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-airflow-cve-2021-38540","parents":[{"from":"CVE-2021-38540","to":"CVE-2023-50783","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/bcec1df703cd4a01520a90c3f801cca6f97d9bfd","https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929"],"basis":"shared function","functions":["action_varexport"]}]}],"packageHistory":[{"cve":"CVE-2023-47265","published":"2023-12-21","fixed":"2.8.0b1","kev":false,"link":{"from":"CVE-2023-47265","to":"CVE-2023-50783","relation":"successor","confidence":"high","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.8.0b1","toFixed":"2.8.0","daysApart":0},{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/0b995602e6e5894ee31625a4dd0e6aa255d2a651","https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929"],"basis":"shared file"}]}},{"cve":"CVE-2023-48291","published":"2023-12-21","fixed":"2.8.0","kev":false},{"cve":"CVE-2023-49920","published":"2023-12-21","fixed":"2.8.0","kev":false},{"cve":"CVE-2023-50783","published":"2023-12-21","fixed":"2.8.0","kev":false},{"cve":"CVE-2023-50943","published":"2024-01-24","fixed":"2.8.1","kev":false},{"cve":"CVE-2023-50944","published":"2024-01-24","fixed":"2.8.1","kev":false},{"cve":"CVE-2024-26280","published":"2024-03-01","fixed":"2.8.2","kev":false}],"package":"PyPI:apache-airflow"}}