CVE-2024-56373
中文标题:
（暂无数据）
英文标题:
Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information
漏洞描述
中文描述:
（暂无数据）
英文描述:
DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | - | < 2.11.1 | - |
cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:*
|
| apache | airflow | * | - | - |
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (adp)
HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2024-56373 |
2026-02-25 03:17:55 | 2026-02-24 22:00:00 |
| NVD | nvd_CVE-2024-56373 |
2026-02-25 02:00:04 | 2026-02-24 22:00:02 |
版本与语言
安全公告
变更历史
查看详细变更
- affected_products_count: 1 -> 2
- references_count: 2 -> 3
- data_sources: ['cve'] -> ['cve', 'nvd']