Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-27604 Details

Description

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA: CISA-ADPCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/apache/airflow/pull/33039 CVEPatchVendor Advisory
https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd CVEMailing ListVendor Advisory
https://github.com/apache/airflow/pull/33039 [email protected]PatchVendor Advisory
https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd [email protected]Mailing ListVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-20Improper Input Validation[email protected]

Affected Products

ProductVersions
apache airflow sqoop provider
< 4.0.0

CPE

  • cpe:2.3:a:apache:airflow_sqoop_provider:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-27604
NVD Published Date:
Aug 28, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-27604 Details - Not Deferred