What is CVE-2023-35005?

CVE-2023-35005 is a medium-severity vulnerability in Apache Airflow, classified under Information Disclosure. CVSS score: 6.5/10. Published 2023-06-19.

How severe is CVE-2023-35005?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in Apache Airflow

CVE-2023-35005

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

Vulnerability class: Information Disclosure

EPSS: 0.015 (72.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Airflow
Apache Software Foundation Airflow — versions 2.5.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security@apache.org (Patch, patch)
security@apache.org (patch, Issue Tracking)
security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)

Frequently asked questions

What is CVE-2023-35005?: CVE-2023-35005 is a medium-severity vulnerability in Apache Airflow, classified under Information Disclosure. CVSS score: 6.5/10. Published 2023-06-19.
How severe is CVE-2023-35005?: Medium severity. CVSS v3 base score is 6.5 out of 10.