The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the insufficient verification of the authenticity of executed requests, allowing an attacker to carry out a CSRF attack.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow relates to the disclosure of protected information, allowing attackers to obtain confidential data.

The vulnerability of the software allows for the creation, monitoring, and orchestration of data processing scenarios in Airflow. This vulnerability involves the exposure of protected information. Exploiting this vulnerability can enable a remote attacker to obtain confidential information...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the insufficient protection of registration data, allowing attackers to disclose sensitive information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information that should be protected...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the ability to disclose information in the error-prone data area, allowing an intruder to gain unauthorized access to the database.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the disclosure of information in the error-prone data area. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized acces...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2024-0101622)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow Apache Airflow cross-site scripting vulnerability , the vulnerabilit...

Apache Airflow Cross-Site Request Forgery Vulnerability (CNVD-2024-0101720)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site request forgery vulnerability exists in Apache Airflow versions 2.7.0...

Apache Airflow Security Bypass Vulnerability (CNVD-2024-0101425)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Apache Airflow Security Bypass Vulnerability (CNVD-2024-0101523)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Improper Authorization

apache-airflow is vulnerable to Improper Authorization. The vulnerability us due to a lack of authorization check while accessing DAG's. An attacker can escalate their privileges to have write access to DAG's of other users...

Cross Site Scripting (XSS)

apache-airflow is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a lack of DAG parameter description sanitization. A DAG author can execute arbitrary JavaScript in the client context, modifying what the task displays in the browser...

Internet Bug Bounty: CVE-2023-49920: Apache Airflow: Missing CSRF protection on DAG/trigger

A vulnerability in Apache Airflow versions 2.7.0 through 2.7.3 allowed triggering of DAGs without CSRF validation, enabling malicious websites to trigger DAG execution without consent in browsers where a user was logged into Airflow. Users were advised to upgrade to 2.8.0 or later...

Apache Airflow Cross-Site Request Forgery vulnerability

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executi...

Apache Airflow Improper Access Control vulnerability

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are...

GHSA-6M9R-7WRX-XMR6 Apache Airflow Cross-Site Request Forgery vulnerability

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executi...

GHSA-5938-79HG-XH3Q Apache Airflow Improper Access Control vulnerability

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are...

Apache Airflow has a stored cross-site scripting vulnerability

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the...

GHSA-8F57-WCMG-4JMH Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

GHSA-PXCH-WR7M-RWXJ Apache Airflow has a stored cross-site scripting vulnerability

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the...

Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

CVE-2023-48291

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...