CVE-2023-28706
9.8
CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.77% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2023-04-07 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| apache | airflow hive provider |
References
- http://www.openwall.com/lists/oss-security/2023/04/07/2
- https://github.com/apache/airflow/pull/30212
- https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3
- http://www.openwall.com/lists/oss-security/2023/04/07/2
- https://github.com/apache/airflow/pull/30212
- https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3
→ the Explorer · watch your stack · NVD