PT-2019-8033

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 1.8.2 and earlier Description The issue allows an authenticated user to execute code remotely on the Airflow webserver by creating a special object. Recommendations For Apache Airflow versions 1.8.2 and earlier, at the...

PT-2019-10037

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.1 Description: The LDAP auth backend in Apache Airflow was misconfigured, containing improper checking of exceptions which disabled server certificate checking. Recommendations: For versions prior to...

CVE-2017-17835: Cross-Site Request Forgery (CSRF)

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow...

CVE-2017-17836: Undefined Security Weakness

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the...

CVE-2018-20245: Improper Certificate Validation

The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...

CVE-2017-15720: Improper Input Validation

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object...

PT-2019-8249

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 1.8.2 and earlier Description A CSRF issue in Apache Airflow allowed for remote command injection on a default installation. Recommendations For Apache Airflow versions 1.8.2 and earlier, at the moment, there is no...

Apache Airflow Cross-Site Scripting Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform has dynamic and scalable features. A cross-site scripting vulnerability exists in the 404 page in Apache Airflow version 1.8.1. A remote...

PYSEC-2018-45

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

Design/Logic Flaw

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

PYSEC-2018-45

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

CVE-2017-12614

CVE-2017-12614 describes a reflected cross-site scripting vulnerability on Apache Airflow 404 pages. The root cause is an XSS in certain 404 endpoints, with Chrome detecting it as reflected but other browsers remaining vulnerable. Affected product: Apache Airflow (version unspecified in the initi...

CVE-2017-12614: Improper Neutralization of Input During Web Page Generation

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

PT-2018-5435

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.9.0 Description: A cross-site scripting XSS issue was identified in certain 404 pages, which could be exploited to perform an XSS attack. While Chrome detects and prevents this as a reflected XSS attempt,...

Insecure Defaults

apache-airflow is vulnerable to insecure defaults. The library uses a default SECRETKEY parameter that is the same for all installations, allowing a malicious user to create an authentic session to the application if the SECRETKEY wasn't changed...

Honda, Universal Music Group Expose Sensitive Data in Misconfig Blunders

Server and cloud misconfigs continue to plague companies and their customers: This week it came to light that a Universal Music Group contractor neglected to protect an Apache Airflow server, leaving data exposed; while a Honda affiliate in India left two Amazon S3 buckets misconfigured for more...