In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
{ "cpes": [ "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*" ], "severity": "High" }