CVE-2023-28707

EPSS 0.18%
Veröffentlicht 07.04.2023 15:15:08
Zuletzt bearbeitet 13.02.2025 17:16:16
Quelle security@apache.org
Teams Watchlist Login
Unerledigt Login

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Apache-airflow-providers-apache-drill Version < 2.3.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.18%	0.394

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.openwall.com/lists/oss-security/2023/04/07/1

Third Party Advisory

Mailing List

https://github.com/apache/airflow/pull/30215

Patch

Vendor Advisory

https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-28707

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-28707

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-28707

EUVD