CVE-2022-46421Critical· 9.8▾ MidnightApache Airflow Hive Provider vulnerable to Command Injection
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
3.3%
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider before 5.0.0.
apache-airflow-providers-apache-hive < 5.0.0Upgrade to a patched release:
apache-airflow-providers-apache-hive 5.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-25696Critical· 9.8Apache Airflow Hive Provider Improper Input Validation vulnerability
CVE-2023-28706Critical· 9.8Apache Airflow Hive Provider vulnerable to code injection
CVE-2023-35797Critical· 9.8Apache Airflow Hive Provider Beeline remote code execution with Principal
CVE-2022-41131High· 7.8OS Command Injection in Apache Airflow
CVE-2023-37415High· 8.8Apache Airflow Apache Hive Provider Improper Input Validation vulnerability
CVE-2023-22884Critical· 9.8Command Injection in Apache Airflow and Apache Airflow MySQL Provider