CVSS: 8.8EPSS: 94%CPEs: 1EXPL: 6CVE-2020-11978 – Apache Airflow Command Injection
https://notcve.org/view.php?id=CVE-2020-11978
16 Jul 2020 — An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable. Se encontró un problema en Apache Airflow versiones 1.10.10 y posteriores. Se ... • https://packetstorm.news/files/id/174764 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-12398
https://notcve.org/view.php?id=CVE-2019-12398
14 Jan 2020 — In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected. En Apache Airflow versiones anteriores a 1.10.5, cuando se ejecuta con la interfaz de usuario "clasic", un usuario administrador malicioso podía editar el estado de los objetos en la base de datos de metadatos de Airflow para ejecutar javascript arbitrario en determin... • http://www.openwall.com/lists/oss-security/2020/01/14/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12417
https://notcve.org/view.php?id=CVE-2019-12417
30 Oct 2019 — A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process. Un usuario administrador malicioso podría editar el estado de los objetos en la base de datos de metadatos de Airflow para ejecutar JavaScript arbitrario en determinadas vistas de página. Esto también presentó una vulnerabilidad de Divulgación de Archivos Local en... • https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc%40%3Cusers.airflow.apache.org%3E • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-0216
https://notcve.org/view.php?id=CVE-2019-0216
10 Apr 2019 — A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. Un usuario administrador malicioso podría editar el estado de los objetos en la base de datos metadata de Airflow para ejecutar JavaScript arbitrario en determinadas vistas de páginas. • http://www.openwall.com/lists/oss-security/2019/04/10/6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-0229
https://notcve.org/view.php?id=CVE-2019-0229
10 Apr 2019 — A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks. Varios endpoints HTTP en el webserver Airflow (tanto RBAC como clásico) no tenían la protección adecuada y eran vulnerables a los ataques de tipo cross-site request forgery (CSRF) • http://www.openwall.com/lists/oss-security/2019/04/10/6 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20244
https://notcve.org/view.php?id=CVE-2018-20244
27 Feb 2019 — In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. En Apache Airflow, en versiones anteriores a la 1.10.2, un administrador malicioso podría editar el estado de objetos en la base de datos de los metadatos de Airflow para ejecutar JavaScript arbitrario en determinadas vistas de páginas. • http://www.openwall.com/lists/oss-security/2019/04/10/6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17835
https://notcve.org/view.php?id=CVE-2017-17835
23 Jan 2019 — In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. En Apache Airflow, en versiones 1.8.2 y anteriores, una vulnerabilidad de Cross-Site Request Forgery (CSRF) permitía la inyección remota de comandos en una instalación por defecto de Airflow. • https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17836
https://notcve.org/view.php?id=CVE-2017-17836
23 Jan 2019 — In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system. En Apache Airflow versión 1.8.2 y anteriores, una función experimental de Airflow mostraba cookies identificadas, así como contraseñas a las bases de datos utilizadas por Airflow. Un atacante que presenta acce... • https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E • CWE-255: Credentials Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15720
https://notcve.org/view.php?id=CVE-2017-15720
23 Jan 2019 — In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. En Apache Airflow, en versiones 1.8.2 y anteriores, un usuario autenticado puede ejecutar código de forma remota en el servidor web de Airflow mediante la creación de un objeto especial. • https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20245
https://notcve.org/view.php?id=CVE-2018-20245
23 Jan 2019 — The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking. El backend de autenticación LDAP (airflow.contrib.auth.backends.ldap_auth), en versiones anteriores a Apache Airflow 1.10.1, se configuró erróneamente y contenía una comprobación incorrecta de excepciones que deshabilitaban la comprobación de certificados del servidor. • https://lists.apache.org/thread.html/b549c7573b342a6e457e5a3225c33054244343927bbfb2a4cdc4cf73%40%3Cdev.airflow.apache.org%3E • CWE-295: Improper Certificate Validation •