CVE-2025-30473

{
  "id": "CVE-2025-30473",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30473",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-08T03:56:19.551055Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow Common SQL Provider",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.24.1",
              "versionType": "semver"
            }
          ],
          "packageName": "apache-airflow-providers-common-sql",
          "collectionURL": "https://pypi.org/project/apache-airflow-providers-common-sql/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-07T09:15:16.667",
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/48098",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/04/04/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/04/06/1",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/04/06/2",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/04/06/3",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.\n\nWhen using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user.\nThis allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.\n\n\nThis issue affects Apache Airflow Common SQL Provider: before 1.24.1.\n\nUsers are recommended to upgrade to version 1.24.1, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('Inyección SQL') en el proveedor SQL común de Apache Airflow. Al usar la cláusula de partición en SQLTableCheckOperator como parámetro (un patrón recomendado), el usuario autenticado de la interfaz de usuario podía inyectar un comando SQL arbitrario al activar el DAG, exponiendo la cláusula de partición al usuario. Esto permitía al usuario que activaba el DAG escalar privilegios para ejecutar dichos comandos arbitrarios, algo que normalmente no tendría. Este problema afecta al proveedor SQL común de Apache Airflow: versiones anteriores a la 1.24.1. Se recomienda actualizar a la versión 1.24.1, que soluciona el problema."
    }
  ],
  "lastModified": "2026-06-17T09:08:49.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:airflow_common_sql_provider:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1C538E3-3A53-4DE7-9ABD-F7293C046752",
              "versionEndExcluding": "1.24.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}