CVE-2024-45498

{"id": "CVE-2024-45498", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-09-07T08:15:11.407", "references": [{"url": "https://github.com/apache/airflow/pull/41873", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/09/06/2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see  https://github.com/apache/airflow/pull/41873 \u00a0for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later."}, {"lang": "es", "value": "Ejemplo de DAG: example_inlet_event_extra.py incluido con Apache Airflow versi\u00f3n 2.10.0 tiene una vulnerabilidad que permite que un atacante autenticado con solo permiso de activaci\u00f3n de DAG ejecute comandos arbitrarios. Si utiliz\u00f3 ese ejemplo como base de sus DAG, revise si no ha copiado el ejemplo peligroso; consulte https://github.com/apache/airflow/pull/41873 para obtener m\u00e1s informaci\u00f3n. Recomendamos no exponer los DAG de ejemplo en su implementaci\u00f3n. Si debe exponer los DAG de ejemplo, actualice Airflow a la versi\u00f3n 2.10.1 o posterior."}], "lastModified": "2025-06-03T21:12:43.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:2.10.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF30198C-D6CF-48A8-A6D1-D4778B0C78D7"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}