Description (CNA)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache Airflow MySQL Provider | affected 0 before 6.2.0 |
CWE
CWE-89
References
- https://github.com/apache/airflow/pull/47254
- https://github.com/apache/airflow/pull/47255
- https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.