CVE-2023-35797
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
CVE-2023-35797 describes an improper input validation vulnerability in Apache Airflow Hive Provider before version 6.1.1. This allows bypassing security checks and remote code execution (RCE) via the principal parameter.
Risk Assessment
Organizations may be exposed to remote code execution, potentially leading to serious security breaches and data loss. Modification of connection details is required, increasing the risk of internal attacks.
Recommendation
It is recommended to update to version 6.1.1 to eliminate this vulnerability. Regular updates of components are crucial for maintaining system security.
Original NVD description (English source)
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.