by Kastro
Paper/Archive/CVE-2023-25696

CVE-2023-25696

Apache Software Foundation Apache Airflow Hive Provider — Apache Airflow Hive Provider Beeline RCE

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.6.806 × 2016.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.

Affected

ProductAffectedFixed inSource
Apache Airflow Hive Provider< 5.1.35.1.3CNA
apache-airflow-providers-apache-hive< 5.1.35.1.3CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/apache/airflow/pull/29502advisorylists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml