by Kastro
Paper/Archive/CVE-2023-25693

CVE-2023-25693

Apache Software Foundation Apache Airflow Sqoop Provider — Sqoop Apache Airflow Provider Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.6.796 × 2015.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.

Affected

ProductAffectedFixed inSource
Apache Airflow Sqoop Provider< 3.1.13.1.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/apache/airflow/pull/29500advisorylists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4