| |
Vulnerability CVE-2023-27604
Published: 2023-08-28
| Description: |
Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ??sqoop import --connect??, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections.
It is recommended to upgrade to a version that is not affected.
This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it. |
Type:
CWE-20 (Improper Input Validation)
References: |
https://github.com/apache/airflow/pull/33039
https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
