Rewterz Threat Advisory – Multiple Dell PowerScale OneFS Vulnerabilities

Rewterz Threat Alert – Royal Ransomware Demands $275 Million From 350 Victims – Active IOCs

November 14, 2023

Rewterz Threat Advisory – Multiple Apache Airflow Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-42781 CVSS:6.5

Apache Airflow could allow a remote authenticated attacker to obtain sensitive information, caused by a permission verification bypass flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to read information about task instances in other DAGs, and use this information to launch further attacks against the affected system.

CVE-2023-47037 CVSS:6.5

Apache Airflow could allow a remote authenticated attacker to bypass security restrictions, caused by improper access control. By submitting specially crafted notes, an attacker could exploit this vulnerability to modify some DAG run detail values.

Impact

Information Disclosure
Security Bypass

Indicators Of Compromise

CVE

CVE-2023-42781
CVE-2023-47037

Affected Vendors

Apache

Affected Products

Apache Airflow 2.7.2

Remediation

Upgrade to the latest version of Apache Airflow, available from the Apache Website.

Apache Website

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo