CRITICAL🇵🇱 Wersja polska

CVE-2025-50213

CVSS 9.8v3.1pub. 2025-06-24upd. 2025-07-11

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Airflow Providers Snowflake

    APP
    Apache
    < 6.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2025-24813CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych

CVE-2024-38856CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Apache OFBiz — nieautoryzowane wykonanie kodu przez błędną autoryzację

CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓ten sam vendor

Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie

CVE-2024-32113CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Path Traversal w Apache OFBiz umożliwiający zdalne wykonanie kodu

CVE-2024-27348CRITICAL9.8⚠ KEVPL ✓ten sam vendor

RCE w Apache HugeGraph-Server — zdalne wykonanie poleceń bez uwierzytelnienia