airflow Archives - CVE Vulnerability

CVE-2020-17515

Sun, 26 Feb 2023 06:38:31 +0000

The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.

The post CVE-2020-17515 appeared first on CVE Vulnerability.

CVE-2020-13944

Sun, 26 Feb 2023 06:37:08 +0000

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

The post CVE-2020-13944 appeared first on CVE Vulnerability.

CVE-2021-35936

Thu, 23 Feb 2023 14:10:34 +0000

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

The post CVE-2021-35936 appeared first on CVE Vulnerability.

CVE-2021-26697

Thu, 23 Feb 2023 14:08:23 +0000

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.

The post CVE-2021-26697 appeared first on CVE Vulnerability.

CVE-2021-26559

Thu, 23 Feb 2023 14:08:21 +0000

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

The post CVE-2021-26559 appeared first on CVE Vulnerability.

CVE-2022-45402

godfreyd94 — Thu, 23 Feb 2023 05:21:26 +0000

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver’s `/login` endpoint.

The post CVE-2022-45402 appeared first on CVE Vulnerability.

CVE-2022-43982

godfreyd94 — Thu, 23 Feb 2023 05:21:14 +0000

In Apache Airflow versions prior to 2.4.2, the “Trigger DAG with config” screen was susceptible to XSS attacks via the `origin` query argument.

The post CVE-2022-43982 appeared first on CVE Vulnerability.

CVE-2022-43985

godfreyd94 — Thu, 23 Feb 2023 05:21:14 +0000

In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver’s `/confirm` endpoint.

The post CVE-2022-43985 appeared first on CVE Vulnerability.

CVE-2022-41672

godfreyd94 — Thu, 23 Feb 2023 05:20:50 +0000

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn’t prevent an already authenticated user from being able to continue using the UI or API.

The post CVE-2022-41672 appeared first on CVE Vulnerability.

CVE-2022-40754

godfreyd94 — Thu, 23 Feb 2023 05:20:38 +0000

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver’s `/confirm` endpoint.

The post CVE-2022-40754 appeared first on CVE Vulnerability.