Apache Apache-Airflow-Providers-Apache-Spark vulnerabilities

3 CVEs affecting Apache Apache-Airflow-Providers-Apache-Spark, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40272, published 2023-08-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-28710, published 2023-04-07. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1.
CVE-2023-40272, published 2023-08-17. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to…
CVE-2022-40954, published 2022-11-22. Medium severity, CVSS 5.5. EPSS: 1.4% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in…