CVE record
CVE-2023-22884
Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
critical
CVSS 9.8 · CVSS_V3
Affected packages
2
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| apache-airflow | pypi | 2.5.1 |
| apache-airflow-providers-mysql | pypi | 4.0.0 |