{"id":"CVE-2021-45230","published":"2022-01-20T10:25:10Z","modified":"2024-08-04T04:39:20Z","title":"Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver","vendor":"Apache","product":"Apache Airflow","tier":"tail","description":{"text":"In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has \"can_create\" permissions on DAG Runs can create Dag Runs for dags that they don't have \"edit\" permissions for.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01709,"percentile":0.77246,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl","tags":["x_refsource_MISC"]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":15.45}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":["Apache Airflow 1.10 1.10.0 to 1.10.15",">= Apache Airflow 2, < 2.2.0"]}],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<2.2.0",">=1.10.0, <2.0.0b1",">=2.0.0, <2.2.0"],"patched":["2.2.0","2.0.0b1"],"from":["GHSA-4jh2-3c85-q67h","PYSEC-2022-11"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0007","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-28359","published":"2021-05-02","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-35936","published":"2021-08-16","fixed":"2.1.2","kev":false},{"cve":"CVE-2021-38540","published":"2021-09-09","fixed":"2.1.3","kev":false,"link":{"from":"CVE-2021-38540","to":"CVE-2021-45230","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.1.3","toFixed":"2.2.0","daysApart":133}]}},{"cve":"CVE-2021-45230","published":"2022-01-20","fixed":"2.2.0","kev":false},{"cve":"CVE-2021-45229","published":"2022-02-25","fixed":"2.2.4rc1","kev":false,"link":{"from":"CVE-2021-45230","to":"CVE-2021-45229","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.2.0","toFixed":"2.2.4rc1","daysApart":36}]}},{"cve":"CVE-2022-24288","published":"2022-02-25","fixed":"2.2.4","kev":false},{"cve":"CVE-2022-38649","published":"2022-11-22","fixed":"2.3.0","kev":false}],"package":"PyPI:apache-airflow"}}