CVE-2023-22887: Apache Airflow path traversal by authenticated user
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected
Other sources
IBM InfoSphere Information Server is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-22887?
The severity of CVE-2023-22887 is high with a severity value of 7.
How does CVE-2023-22887 affect Apache Airflow?
CVE-2023-22887 affects Apache Airflow versions before 2.6.3.
What is the affected software for CVE-2023-22887?
The affected software for CVE-2023-22887 includes Apache Airflow versions before 2.6.3 and IBM InfoSphere Information Server version 11.7.
Is CVE-2023-22887 considered a low or high vulnerability?
CVE-2023-22887 is considered a high vulnerability.
How can I fix CVE-2023-22887?
To fix CVE-2023-22887, update Apache Airflow to version 2.6.3 and follow the IBM InfoSphere Information Server patch provided by IBM.