CVE-2023-35797Critical· 9.8▾ MidnightApache Airflow Hive Provider Beeline remote code execution with Principal
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.8%
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.
Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details.
It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
apache-airflow-providers-apache-hive < 6.1.1Upgrade to a patched release:
apache-airflow-providers-apache-hive 6.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2023-25696Critical· 9.8Apache Airflow Hive Provider Improper Input Validation vulnerability
CVE-2023-28706Critical· 9.8Apache Airflow Hive Provider vulnerable to code injection
CVE-2022-46421Critical· 9.8Apache Airflow Hive Provider vulnerable to Command Injection
CVE-2023-37415High· 8.8Apache Airflow Apache Hive Provider Improper Input Validation vulnerability
CVE-2022-41131High· 7.8OS Command Injection in Apache Airflow
CVE-2023-25693Critical· 9.8Apache Airflow Sqoop Provider Improper Input Validation vulnerability