CVE-2020-11978
Apache Airflow Command Injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
YesDecision
Descriptions
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Se encontró un problema en Apache Airflow versiones 1.10.10 y posteriores. Se detectó una vulnerabilidad de inyección de código y comando remota en uno de los DAG de ejemplo enviados con Airflow que permitiría a cualquier usuario autenticado ejecutar comandos arbitrarios como el usuario que ejecuta el programador y trabajador de airflow (dependiendo del ejecutor en uso). Si ya presentas ejemplos deshabilitados al configurar la función load_examples=False en la configuración, entonces no es vulnerable
Apache Airflow versions 1.10.10 and below suffer from a remote code execution vulnerability.
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-04-21 CVE Reserved
- 2020-07-16 CVE Published
- 2021-06-01 First Exploit
- 2022-01-18 Exploited in Wild
- 2022-07-18 KEV Due Date
- 2024-08-04 CVE Updated
- 2024-09-10 EPSS Updated
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (5)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|